dalli 3.2.7 → 3.2.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a98f25c5f6f750d72b83fdd0b6e45a9d693520a91b9b7d985bd26fd0abfac41e
-  data.tar.gz: 9e95098e69ece841757034d69cc2091e0b450feed17290bf5fffd527e6d45ac7
+  metadata.gz: 2fe56d2ea432b05cde81f7b4c5e3017fc8e11788526cd3dbecbaede2e11c1659
+  data.tar.gz: 450380fe328c475a93b32d4b1cca10fef1d33065d13bed32e1126276621c2e54
 SHA512:
-  metadata.gz: 25368bee67a5fd00aa7795cc06839c366fb7c1c33386ca0304c1cdfee3a4c82729716128d8f452cb7e0c0e2c24e2c3aec384eb7e3e0ee68c3915d93e17917456
-  data.tar.gz: f0094059b3e7430b3b03a0a6d8795ba0e76bdf1622ba2531b3ceffa11ebb3fb2442a4512a5c98e27e00fba253a7241fb58f47e3f93c58944676c8cd5d0dfe123
+  metadata.gz: ccdbfa346efdf6a09ab53fbd4e44179b298028e348716780b5356d909270fce2fa5fdf66f00579703ab9e0a15dde4b699faf483b5fadb016cff434b85b99011a
+  data.tar.gz: 3c312e4303bf6b076b20fa28a73277b3975396af12cbee42e3c1cceaab9fde3cb679422f3301a0c3c06a784f3706c704d1e181207bb107b245db2683d7f0c690

data/CHANGELOG.md

@@ -4,6 +4,25 @@ Dalli Changelog
 Unreleased
 ==========
 
+3.2.9
+==========
+
+Security:
+
+- Fix memcached command injection through the `incr`/`decr` default with the meta protocol (GHSA-6wmv-xq9m-fmp7)
+  - With `protocol: :meta`, the `default` argument of `incr`/`decr` was written into the command without conversion, so a String containing CRLF injected additional memcached commands (e.g. `set`, `flush_all`) on the connection. The default binary protocol is not affected
+  - `default` must now be an Integer, or a String of decimal digits; anything else raises `ArgumentError` before a request is sent
+  - As defense in depth, the meta `RequestFormatter` now converts every numeric flag it writes (`D`, `J`, `N`, `T`) to an Integer
+  - Thanks to oss-security-shop for the report
+
+3.2.8
+==========
+
+- Handle IO::TimeoutError when establishing connection (eugeneius)
+- Drop dependency on base64 gem (Earlopain)
+- Address incompatibility with resolv-replace (y9v)
+- Add rubygems.org metadata (m-nakamura145)
+
 3.2.7
 ==========
 

data/lib/dalli/client.rb

@@ -257,6 +257,8 @@ module Dalli
     ##
     # Incr adds the given amount to the counter on the memcached server.
     # Amt must be a positive integer value.
+    # Default, if given, must be an Integer (or a String of decimal digits);
+    # anything else raises ArgumentError.
     #
     # If default is nil, the counter must already exist or the operation
     # will fail and will return nil.  Otherwise this method will return
@@ -269,6 +271,7 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def incr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
+      validate_integer!(:default, default)
 
       perform(:incr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -276,6 +279,8 @@ module Dalli
     ##
     # Decr subtracts the given amount from the counter on the memcached server.
     # Amt must be a positive integer value.
+    # Default, if given, must be an Integer (or a String of decimal digits);
+    # anything else raises ArgumentError.
     #
     # memcached counters are unsigned and cannot hold negative values.  Calling
     # decr on a counter which is 0 will just return 0.
@@ -291,6 +296,7 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def decr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
+      validate_integer!(:default, default)
 
       perform(:decr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -373,6 +379,14 @@ module Dalli
       raise ArgumentError, "Positive values only: #{amt}" if amt.negative?
     end
 
+    # Numeric arguments that become meta protocol flags (GHSA-6wmv-xq9m-fmp7).
+    # Checked before the request starts so a bad value raises a clean
+    # ArgumentError, instead of Protocol::Base#request logging it as
+    # unexpected and closing the connection.
+    def validate_integer!(name, value)
+      Dalli::Protocol::Meta::RequestFormatter.integer_flag(name, value) unless value.nil?
+    end
+
     def cas_core(key, always_set, ttl = nil, req_options = nil)
       (value, cas) = perform(:cas, key)
       return if value.nil? && !always_set

data/lib/dalli/protocol/connection_manager.rb

@@ -55,7 +55,7 @@ module Dalli
         @sock = memcached_socket
         @pid = PIDCache.pid
         @request_in_progress = false
-      rescue SystemCallError, Timeout::Error, EOFError, SocketError => e
+      rescue SystemCallError, *TIMEOUT_ERRORS, EOFError, SocketError => e
         # SocketError = DNS resolution failure
         error_on_request!(e)
       end

data/lib/dalli/protocol/meta/key_regularizer.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'base64'
-
 module Dalli
   module Protocol
     class Meta
@@ -17,13 +15,15 @@ module Dalli
         def self.encode(key)
           return [key, false] if key.ascii_only? && !WHITESPACE.match(key)
 
-          [Base64.strict_encode64(key), true]
+          strict_base64_encoded = [key].pack('m0')
+          [strict_base64_encoded, true]
         end
 
         def self.decode(encoded_key, base64_encoded)
           return encoded_key unless base64_encoded
 
-          Base64.strict_decode64(encoded_key).force_encoding(Encoding::UTF_8)
+          strict_base64_decoded = encoded_key.unpack1('m0')
+          strict_base64_decoded.force_encoding(Encoding::UTF_8)
         end
       end
     end

data/lib/dalli/protocol/meta/request_formatter.rb

@@ -21,7 +21,7 @@ module Dalli
           cmd << ' v f' if value
           cmd << ' c' if return_cas
           cmd << ' b' if base64
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << ' k q s' if quiet # Return the key in the response if quiet
           cmd + TERMINATOR
         end
@@ -32,7 +32,7 @@ module Dalli
           cmd << ' b' if base64
           cmd << " F#{bitflags}" if bitflags
           cmd << cas_string(cas)
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << " M#{mode_to_token(mode)}"
           cmd << ' q' if quiet
           cmd << TERMINATOR
@@ -44,7 +44,7 @@ module Dalli
           cmd = "md #{key}"
           cmd << ' b' if base64
           cmd << cas_string(cas)
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << ' q' if quiet
           cmd + TERMINATOR
         end
@@ -52,10 +52,10 @@ module Dalli
         def self.meta_arithmetic(key:, delta:, initial:, incr: true, cas: nil, ttl: nil, base64: false, quiet: false)
           cmd = "ma #{key} v"
           cmd << ' b' if base64
-          cmd << " D#{delta}" if delta
-          cmd << " J#{initial}" if initial
+          cmd << " D#{integer_flag(:delta, delta)}" if delta
+          cmd << " J#{integer_flag(:initial, initial)}" if initial
           # Always set a TTL if an initial value is specified
-          cmd << " N#{ttl || 0}" if ttl || initial
+          cmd << " N#{ttl ? integer_flag(:ttl, ttl) : 0}" if ttl || initial
           cmd << cas_string(cas)
           cmd << ' q' if quiet
           cmd << " M#{incr ? 'I' : 'D'}"
@@ -104,6 +104,18 @@ module Dalli
         end
         # rubocop:enable Metrics/MethodLength
 
+        # Numeric flag values are written straight into the command line, so a
+        # value that isn't an integer -- e.g. a String carrying CRLF -- would let
+        # the caller inject further memcached commands (GHSA-6wmv-xq9m-fmp7).
+        # Converting to Integer means only digits ever reach the wire. Strings
+        # are parsed as base 10 so "010" means 10, as memcached would read it,
+        # rather than octal 8.
+        def self.integer_flag(name, value)
+          value.is_a?(String) ? Integer(value, 10) : Integer(value)
+        rescue ArgumentError, TypeError, FloatDomainError
+          raise ArgumentError, "#{name} must be an Integer, got #{value.inspect}"
+        end
+
         def self.cas_string(cas)
           cas = parse_to_64_bit_int(cas, nil)
           cas.nil? || cas.zero? ? '' : " C#{cas}"

data/lib/dalli/socket.rb

@@ -88,22 +88,30 @@ module Dalli
       # options - supports enhanced logging in the case of a timeout
       attr_accessor :options
 
-      if RUBY_VERSION >= '3.0'
-        def self.open(host, port, options = {})
-          sock = new(host, port, connect_timeout: options[:socket_timeout])
+      def self.open(host, port, options = {})
+        create_socket_with_timeout(host, port, options) do |sock|
           sock.options = { host: host, port: port }.merge(options)
           init_socket_options(sock, options)
 
           options[:ssl_context] ? wrapping_ssl_socket(sock, host, options[:ssl_context]) : sock
         end
-      else
-        def self.open(host, port, options = {})
+      end
+
+      def self.create_socket_with_timeout(host, port, options)
+        # Check that TCPSocket#initialize was not overwritten by resolv-replace gem
+        # (part of ruby standard library since 3.0.0, should be removed in 3.4.0),
+        # as it does not handle keyword arguments correctly.
+        # To check this we are using the fact that resolv-replace
+        # aliases TCPSocket#initialize method to #original_resolv_initialize.
+        # https://github.com/ruby/resolv-replace/blob/v0.1.1/lib/resolv-replace.rb#L21
+        if RUBY_VERSION >= '3.0' &&
+           !::TCPSocket.private_instance_methods.include?(:original_resolv_initialize)
+          sock = new(host, port, connect_timeout: options[:socket_timeout])
+          yield(sock)
+        else
           Timeout.timeout(options[:socket_timeout]) do
             sock = new(host, port)
-            sock.options = { host: host, port: port }.merge(options)
-            init_socket_options(sock, options)
-
-            options[:ssl_context] ? wrapping_ssl_socket(sock, host, options[:ssl_context]) : sock
+            yield(sock)
           end
         end
       end

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '3.2.7'
+  VERSION = '3.2.9'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.4'
 end

metadata

@@ -1,30 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 3.2.7
+  version: 3.2.9
 platform: ruby
 authors:
 - Peter M. Goldstein
 - Mike Perham
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-01-28 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: base64
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
 description: High performance memcached client for Ruby
 email:
 - peter.m.goldstein@gmail.com
@@ -73,8 +58,9 @@ homepage: https://github.com/petergoldstein/dalli
 licenses:
 - MIT
 metadata:
+  bug_tracker_uri: https://github.com/petergoldstein/dalli/issues
+  changelog_uri: https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -89,8 +75,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.5
-signing_key:
+rubygems_version: 4.0.21
 specification_version: 4
 summary: High performance memcached client for Ruby
 test_files: []