CVE-2026-33637

@@ -481,9 +481,11 @@ def build_exclusive_url(url = nil, params = nil, params_encoder = nil)
       if url && !base.path.end_with?('/')
         base.path = "#{base.path}/" # ensure trailing slash
       end
+      url = url.to_s if url.respond_to?(:host)
       # Ensure relative url will be parsed correctly (such as `service:search` or `//evil.com`)
       url = "./#{url}" if url.respond_to?(:start_with?) &&
-                          (!url.start_with?('http://', 'https://', '/', './', '../') || url.start_with?('//'))
+                          (url.start_with?('//') ||
+                           !url.start_with?('http://', 'https://', '/', './', '../'))
       uri = url ? base + url : base
       if params
         uri.query = params.to_query(params_encoder || options.params_encoder)

@@ -38,12 +38,12 @@ Metrics/AbcSize:
 # Offense count: 4
 # Configuration parameters: CountComments, CountAsOne.
 Metrics/ClassLength:
-  Max: 231
+  Max: 233
 
 # Offense count: 8
 # Configuration parameters: AllowedMethods, AllowedPatterns.
 Metrics/CyclomaticComplexity:
-  Max: 13
+  Max: 14
 
 # Offense count: 28
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.

@@ -318,6 +318,13 @@ def decode(params)
         expect(uri.host).to eq('httpbingo.org')
       end
 
+      it 'does not allow host override with URI("//evil.com/path")' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url(URI('//evil.com/path?token=1'))
+        expect(uri.host).to eq('httpbingo.org')
+        expect(uri.query).to eq('token=1')
+      end
+
       it 'does not allow host override with //evil.com:8080/path' do
         conn.url_prefix = 'http://httpbingo.org/api'
         uri = conn.build_exclusive_url('//evil.com:8080/path')

@@ -31,6 +31,15 @@
     it { expect(subject.to_env(conn).url.to_s).to eq('http://httpbingo.org/api/foo.json?a=1') }
   end
 
+  context 'when setting the url on setup with a protocol-relative URI' do
+    let(:block) { proc { |req| req.url URI.parse('//evil.com/path?token=1') } }
+    let(:url) { subject.to_env(conn).url }
+
+    it { expect(url.host).to eq('httpbingo.org') }
+    it { expect(url.path).to eq('/api///evil.com/path') }
+    it { expect(url.query).to eq('token=1') }
+  end
+
   context 'when setting the url on setup with a string path and params' do
     let(:block) { proc { |req| req.url 'foo.json', 'a' => 1 } }