lostisland / faraday / #4105

93%

master: 92%

push

Merge commit from fork

Protocol-relative URLs (e.g. `//evil.com/path`) bypassed the existing
relative-URL guard in `build_exclusive_url`, allowing an attacker-controlled
URL to override the connection's base host. The `//` prefix matched the
`/` check in `start_with?`, so these URLs were passed through to
`URI#+` which treated them as authority references, replacing the host.

Extend the guard condition so that URLs starting with `//` are also
prefixed with `./`, neutralising the authority component and keeping
requests scoped to the configured base host.

Security: GHSA-33mh-2634-fwr2

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2 of 2 new or added lines in 1 file covered. (100.0%)

1448 of 1525 relevant lines covered (94.95%)

152.48 hits per line