webrick: filter out HTTP_PROXY for CGIHandler

* lib/webrick/httpservlet/cgihandler.rb (do_GET): delete HTTP_PROXY
* test/webrick/test_cgi.rb (test_cgi_env): new test
* test/webrick/webrick.cgi (do_GET): new endpoint to dump env
  [ruby-core:76511] [Bug #12610]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55731 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

Author: normal

lib/webrick/httpservlet/cgihandler.rb

@@ -52,6 +52,7 @@ def do_GET(req, res)
           meta = req.meta_vars
           meta["SCRIPT_FILENAME"] = @script_filename
           meta["PATH"] = @config[:CGIPathEnv]
+          meta.delete("HTTP_PROXY")
           if /mswin|bccwin|mingw/ =~ RUBY_PLATFORM
             meta["SystemRoot"] = ENV["SystemRoot"]
           end

test/webrick/test_cgi.rb

@@ -114,6 +114,20 @@ def test_bad_request
     }
   end
 
+  def test_cgi_env
+    start_cgi_server do |server, addr, port, log|
+      http = Net::HTTP.new(addr, port)
+      req = Net::HTTP::Get.new("/webrick.cgi/dumpenv")
+      req['proxy'] = 'http://example.com/'
+      req['hello'] = 'world'
+      http.request(req) do |res|
+        env = Marshal.load(res.body)
+        assert_equal 'world', env['HTTP_HELLO']
+        assert_not_operator env, :include?, 'HTTP_PROXY'
+      end
+    end
+  end
+
   CtrlSeq = [0x7f, *(1..31)].pack("C*").gsub(/\s+/, '')
   CtrlPat = /#{Regexp.quote(CtrlSeq)}/o
   DumpPat = /#{Regexp.quote(CtrlSeq.dump[1...-1])}/o

test/webrick/webrick.cgi

@@ -4,7 +4,9 @@ require "webrick/cgi"
 class TestApp < WEBrick::CGI
   def do_GET(req, res)
     res["content-type"] = "text/plain"
-    if (p = req.path_info) && p.length > 0
+    if req.path_info == "/dumpenv"
+      res.body = Marshal.dump(ENV.to_hash)
+    elsif (p = req.path_info) && p.length > 0
       res.body = p
     elsif (q = req.query).size > 0
       res.body = q.keys.sort.collect{|key|