Fix/CVE 2025 61594 uri credential leakage

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes

[224599437]

This PR remediates URI credential leakage behavior associated with CVE-2025-61594 in doubtfire-api.

Summary of changes
Updated dependency constraint in Gemfile to gem 'uri', '>= 1.1.1'.
Updated Gemfile.lock to resolve uri to 1.1.1.
Added runtime hardening initializer at config/initializers/uri_credential_leak_mitigation.rb:
Intercepts URI#+ merges.
When a credential-bearing base URI is combined with a relative URI, strips user and password from the resulting URI.
Prevents credential propagation into constructed URLs.
Motivation / context
Pentest PoC confirmed credential-bearing userinfo could persist in merged URIs and be exposed in downstream flows (logs, redirects, API/service requests).
Although user login credentials are not directly impacted, leakage of internal integration credentials is a high-severity operational risk.
The dependency bump alone did not eliminate observed behavior in runtime testing, so this PR includes an application-layer mitigation (defense in depth) to enforce safe URI merge output.

Dependencies required
uri >= 1.1.1 (recorded in Gemfile and Gemfile.lock).
Fixes # (issue)

Type of change

Bug fix (non-breaking change which fixes an issue)

New feature (non-breaking change which adds functionality)

Breaking change (fix or feature that would cause existing functionality to not work as expected)

This change requires a documentation update
How Has This Been Tested?
Validation was performed in the containerized API runtime using reproducible commands.

Ensure containers are running:
docker compose up -d doubtfire-api
Verify runtime versions:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri/version"
puts "Ruby: #{RUBY_VERSION}"
puts "URI gem: #{URI::VERSION}"
"
'
Reproduce CVE PoC behavior check:
docker compose run --rm doubtfire-api bash -lc '
cd /doubtfire && bundle exec rails runner "
require "uri"
base = URI.parse("https://fakeuser:fakepass@internal.example/service\")
target = URI.parse("/steal")
combined = base + target
puts "Base: #{base}"
puts "Target: #{target}"
puts "Combined: #{combined}"
if combined.to_s.include?("fakeuser:fakepass@")
puts "RESULT: VULNERABLE (CVE-2025-61594)"
else
puts "RESULT: SAFE"
end
"
'
Observed result after fix:
Ruby: 3.4.9
URI gem: 1.1.1
Combined: https://internal.example/steal
RESULT: SAFE

Before the fix:

After the fix:

Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I have added tests that prove my fix is effective
New and existing unit tests pass locally with my changes