Reject protocol-relative inputs in base_uri / persistent resolution

When HTTP::Client is configured with `base_uri:` or
`HTTP.persistent("...")`, the builder previously passed user-supplied
path strings straight into `URI#join` (via `String(base.join(uri))`)
or naive concatenation (`"#{persistent}#{uri}"`).

Per RFC 3986 §5.2, an input starting with `//` is a network-path
reference and replaces the authority of the base. The existing
`HTTP_OR_HTTPS_RE` guard only rejected `http://` and `https://`
prefixes, so a bare `//evil.example/x` slipped through and turned
a base_uri-scoped request into one to an attacker-chosen host.

The same call also keeps any connection-scoped headers (`HTTP.auth(...)`
bearer, custom `X-API-Key`, etc.), so the primitive is a one-shot
SSRF plus credential leak — no follow-redirect chain is involved,
so the usual strip-on-redirect defences never run.

Fix: when the resolver sees a `//`-prefixed input on the base_uri or
persistent branch, prepend `./` before delegating so the input
resolves as an ordinary relative path under the configured base.

Regression coverage in test/http/request/builder_test.rb covers
`//evil.com/x`, `//evil.com:port/x`, `//user:pass@evil.com/x`,
`///evil.com`, plus persistent + benign-absolute + benign-relative
shapes, mirroring the test cases used for the equivalent fix in
sibling Ruby HTTP-client gems.

Reported privately as GHSA-r98x-p6m8-xcrv.

Author: tonghuaroot

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Security
+
+- `HTTP::Request::Builder#make_request_uri` now rejects protocol-relative inputs
+  (`//host/path`) when resolving against a configured `base_uri` or `persistent`
+  origin. Previously such inputs flowed into `URI#merge` and replaced the base
+  authority, allowing an attacker who controlled the path argument to redirect
+  the request to an arbitrary host and leak any connection-scoped headers
+  (`HTTP.auth(...)`, etc.). See `GHSA-r98x-p6m8-xcrv` for details.
+
 ## [6.0.3] - 2026-04-20
 
 ### Fixed

lib/http/request/builder.rb

@@ -84,8 +84,18 @@ def make_request_uri(uri)
         uri = uri.to_s
 
         if @options.base_uri? && uri !~ HTTP_OR_HTTPS_RE
+          # A leading "//" makes the input a protocol-relative (network-path)
+          # reference per RFC 3986 §4.2 / §5.2. Passing it to base.join /
+          # URI#merge would replace the base authority with the input's host,
+          # turning a base_uri-scoped request into one to an arbitrary host.
+          # Prepend "./" so it resolves as a normal relative path under base.
+          uri = "./#{uri}" if uri.start_with?("//")
           uri = resolve_against_base(uri)
         elsif @options.persistent? && uri !~ HTTP_OR_HTTPS_RE
+          # Same hazard against the persistent-host concatenation: a leading
+          # "//" produces "scheme://persistent//evil/path" which HTTP::URI.parse
+          # normalises into scheme://evil/path. Force a relative-path prefix.
+          uri = "./#{uri}" if uri.start_with?("//")
           uri = "#{@options.persistent}#{uri}"
         end
 

test/http/request/builder_test.rb

@@ -620,4 +620,63 @@ def test_make_form_data_with_plain_hash_creates_form_data_and_sets_content_type
 
     assert_includes chunks.join, "key=value"
   end
+
+  # Regression coverage for protocol-relative (network-path-reference) inputs.
+  # Without the guard in make_request_uri, an input like "//evil.com/path"
+  # bypasses HTTP_OR_HTTPS_RE and reaches base.join, which per RFC 3986 §5.2
+  # replaces the base authority with the input host — turning a base_uri-scoped
+  # request into one to an arbitrary host while keeping connection-scoped
+  # headers (Authorization, etc.).
+  def test_build_with_base_uri_and_protocol_relative_does_not_override_host
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "//evil.com/leak")
+
+    assert_equal "example.com", req.uri.host
+    refute_equal "evil.com", req.uri.host
+  end
+
+  def test_build_with_base_uri_and_protocol_relative_with_port_does_not_override_host
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "//evil.com:8080/leak")
+
+    assert_equal "example.com", req.uri.host
+  end
+
+  def test_build_with_base_uri_and_protocol_relative_with_userinfo_does_not_override_host
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "//user:pass@evil.com/leak")
+
+    assert_equal "example.com", req.uri.host
+  end
+
+  def test_build_with_base_uri_and_triple_slash_does_not_override_host
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "///evil.com")
+
+    assert_equal "example.com", req.uri.host
+  end
+
+  def test_build_with_persistent_and_protocol_relative_does_not_override_host
+    builder = build_builder(persistent: "http://example.com")
+    req = builder.build(:get, "//evil.com/leak")
+
+    assert_equal "example.com", req.uri.host
+    refute_equal "evil.com", req.uri.host
+  end
+
+  def test_build_with_base_uri_still_allows_absolute_paths_after_fix
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "/safe/path")
+
+    assert_equal "example.com", req.uri.host
+    assert_equal "/safe/path", req.uri.path
+  end
+
+  def test_build_with_base_uri_still_allows_plain_relative_after_fix
+    builder = build_builder(base_uri: "http://example.com/api/")
+    req = builder.build(:get, "users/me")
+
+    assert_equal "example.com", req.uri.host
+    assert_equal "/api/users/me", req.uri.path
+  end
 end