dalli 4.3.3 → 4.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57b78e30ee409a2d742fc47ee57ccdd482fe9c75f369366ae315b7ef8b649934
-  data.tar.gz: b8cad66f3cba53bbcb84b18f406eed60f22209c10dd4a312063a1e13189185ca
+  metadata.gz: 96ac26bd7ef748d2407efaa5d1bcfe8f762c2eb47d67f85fb6e19f789926abae
+  data.tar.gz: 617744189a342d6b39bd741a685b997bb0fbbae82afb3aeaafbf87ac79f6fe29
 SHA512:
-  metadata.gz: 18b26e3c4aa30e5f8b4195d95307afca6c9240dd1154a36966d40d52047e638758850ec06e2a40fd1bd8e69fe150dee7409b1f4a565f0a80e397aaf115315463
-  data.tar.gz: b6db69ecbc1e6d34587d8ec29b861f6a71c863b36229d3c642e3d0e646ba6234e3bac04225d64ff174d12f35b728663e82e1d2b5f7e93dc9ac3e1ff33fd58db3
+  metadata.gz: 7c0f37ce570d445484045722da9d5463879d825cb0ff2c8436e59852e0a996b44be61ebf942eb7bfc14846fb64991edf4cbf75c5bfa5871d8f3409b8a3fae25d
+  data.tar.gz: 3a96488a8bb4da71afbb724745da958bec01ce5e9e229d7b5f0be0f5bd56513a0de7acefba6feab012efab5cd8d9971a5956a4aa5f1c9b154f503721bd703b72

data/CHANGELOG.md

@@ -1,6 +1,36 @@
 Dalli Changelog
 =====================
 
+Unreleased
+==========
+
+4.3.5
+==========
+
+Bug fixes:
+
+- Fix multi-server `get_multi` stopping at an empty value (#1170)
+  - The pipelined reply parser took a hit on a zero-length value (`VA 0`) for the terminating `MN`, so that server's remaining keys were silently missing from the result
+  - Its value terminator and any replies not yet parsed stayed on the connection and were read as the replies to later commands on it. Those commands could fail with `Dalli::DalliError: Response error`, or a single-key `get` could silently return another key's value
+  - An empty value is now returned as `''`, like a single-key `get` and single-server `get_multi`
+  - Affects only clients using `protocol: :meta`; the default binary protocol is not affected
+  - Thanks to Julian Richard Contreras for this contribution
+
+Development:
+
+- Fix offenses reported by RuboCop 1.91 and require `rubocop >= 1.91` (backport of #1162)
+
+4.3.4
+==========
+
+Security:
+
+- Fix memcached command injection through numeric arguments with the meta protocol (GHSA-6wmv-xq9m-fmp7)
+  - With `protocol: :meta`, the `default` argument of `incr`/`decr`, and `fetch_with_lock`'s `lock_ttl` and `recache_threshold`, were written into the command without conversion, so a String containing CRLF injected additional memcached commands (e.g. `set`, `flush_all`) on the connection. The default binary protocol is not affected
+  - These arguments must now be Integers, or Strings of decimal digits; anything else raises `ArgumentError` before a request is sent
+  - As defense in depth, the meta `RequestFormatter` now converts every numeric flag it writes (`D`, `J`, `N`, `R`, `T`) to an Integer
+  - Thanks to oss-security-shop for the report
+
 4.3.3
 ==========
 

data/Gemfile

@@ -18,7 +18,7 @@ group :development, :test do
   gem 'rack', '~> 3'
   gem 'rack-session'
   gem 'rake', '~> 13.0'
-  gem 'rubocop'
+  gem 'rubocop', '>= 1.91' # disable-next directives require 1.91+
   gem 'rubocop-minitest'
   gem 'rubocop-performance'
   gem 'rubocop-rake'

data/lib/dalli/client.rb

@@ -3,7 +3,6 @@
 require 'digest/md5'
 require 'set'
 
-# encoding: ascii
 module Dalli
   ##
   # Dalli::Client is the main class which developers will use to interact with
@@ -152,7 +151,7 @@ module Dalli
     # Fetch multiple keys efficiently.
     # If a block is given, yields key/value pairs one at a time.
     # Otherwise returns a hash of { 'key' => 'value', 'key2' => 'value1' }
-    # rubocop:disable Style/ExplicitBlockArgument
+    # rubocop:disable-next Style/ExplicitBlockArgument
     def get_multi(*keys)
       keys.flatten!
       keys.compact!
@@ -164,7 +163,6 @@ module Dalli
         get_multi_hash(keys)
       end
     end
-    # rubocop:enable Style/ExplicitBlockArgument
 
     ##
     # Fetch multiple keys efficiently, including available metadata such as CAS.
@@ -237,6 +235,8 @@ module Dalli
       raise ArgumentError, 'Block is required for fetch_with_lock' unless block_given?
 
       raise_unless_meta_protocol!
+      validate_integer!(:lock_ttl, lock_ttl)
+      validate_integer!(:recache_threshold, recache_threshold)
 
       key = key.to_s
       key = @key_manager.validate_key(key)
@@ -402,6 +402,8 @@ module Dalli
     ##
     # Incr adds the given amount to the counter on the memcached server.
     # Amt must be a positive integer value.
+    # Default, if given, must be an Integer (or a String of decimal digits);
+    # anything else raises ArgumentError.
     #
     # If default is nil, the counter must already exist or the operation
     # will fail and will return nil.  Otherwise this method will return
@@ -414,6 +416,7 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def incr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
+      validate_integer!(:default, default)
 
       perform(:incr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -421,6 +424,8 @@ module Dalli
     ##
     # Decr subtracts the given amount from the counter on the memcached server.
     # Amt must be a positive integer value.
+    # Default, if given, must be an Integer (or a String of decimal digits);
+    # anything else raises ArgumentError.
     #
     # memcached counters are unsigned and cannot hold negative values.  Calling
     # decr on a counter which is 0 will just return 0.
@@ -436,6 +441,7 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def decr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
+      validate_integer!(:default, default)
 
       perform(:decr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -577,6 +583,14 @@ module Dalli
       raise ArgumentError, "Positive values only: #{amt}" if amt.negative?
     end
 
+    # Numeric arguments that become meta protocol flags (GHSA-6wmv-xq9m-fmp7).
+    # Checked before the request starts so a bad value raises a clean
+    # ArgumentError, instead of Protocol::Base#request logging it as
+    # unexpected and closing the connection.
+    def validate_integer!(name, value)
+      Dalli::Protocol::Meta::RequestFormatter.integer_flag(name, value) unless value.nil?
+    end
+
     def cas_core(key, always_set, ttl = nil, req_options = nil)
       (value, cas) = perform(:cas, key)
       return if value.nil? && !always_set

data/lib/dalli/protocol/base.rb

@@ -94,7 +94,7 @@ module Dalli
       # When a block is given, yields (key, value, cas) for each response,
       # avoiding intermediate Hash allocation. Returns nil.
       # Without a block, returns a Hash of { key => [value, cas] }.
-      # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
       def pipeline_next_responses(&block)
         reconnect_on_pipeline_complete!
         values = nil
@@ -128,7 +128,6 @@ module Dalli
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
         @connection_manager.error_on_request!(e)
       end
-      # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
       # Abort current pipelined get. Generally used to signal an external
       # timeout during pipelined get.  The underlying socket is

data/lib/dalli/protocol/binary/request_formatter.rb

@@ -88,7 +88,7 @@ module Dalli
         }.freeze
         FORMAT = BODY_FORMATS.transform_values { |v| REQ_HEADER_FORMAT + v }
 
-        # rubocop:disable Metrics/ParameterLists
+        # rubocop:disable-next Metrics/ParameterLists
         def self.standard_request(opkey:, key: nil, value: nil, opaque: 0, cas: 0, bitflags: nil, ttl: nil)
           extra_len = (bitflags.nil? ? 0 : 4) + (ttl.nil? ? 0 : 4)
           key_len = key.nil? ? 0 : key.bytesize
@@ -97,7 +97,6 @@ module Dalli
           body = [bitflags, ttl, key, value].compact
           (header + body).pack(FORMAT[opkey])
         end
-        # rubocop:enable Metrics/ParameterLists
 
         def self.decr_incr_request(opkey:, key: nil, count: nil, initial: nil, expiry: nil)
           extra_len = 20

data/lib/dalli/protocol/binary.rb

@@ -76,7 +76,7 @@ module Dalli
         storage_req(opkey, key, value, ttl, cas, options)
       end
 
-      # rubocop:disable Metrics/ParameterLists
+      # rubocop:disable-next Metrics/ParameterLists
       def storage_req(opkey, key, value, ttl, cas, options)
         (value, bitflags) = @value_marshaller.store(key, value, options)
         ttl = TtlSanitizer.sanitize(ttl)
@@ -88,7 +88,6 @@ module Dalli
         @connection_manager.flush unless quiet?
         response_processor.storage_response unless quiet?
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def append(key, value)
         opkey = quiet? ? :appendq : :append

data/lib/dalli/protocol/meta/request_formatter.rb

@@ -45,10 +45,11 @@ module Dalli
           cmd << (skip_flags ? ' v' : ' v f') if value
           cmd << ' c' if return_cas
           cmd << ' b' if base64
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << ' k q s' if quiet # Return the key in the response if quiet
-          cmd << " N#{vivify_ttl}" if vivify_ttl # Thundering herd: vivify on miss
-          cmd << " R#{recache_ttl}" if recache_ttl # Thundering herd: win recache if TTL below threshold
+          cmd << " N#{integer_flag(:vivify_ttl, vivify_ttl)}" if vivify_ttl # Thundering herd: vivify on miss
+          # Thundering herd: win recache if TTL below threshold
+          cmd << " R#{integer_flag(:recache_ttl, recache_ttl)}" if recache_ttl
           cmd << ' h' if return_hit_status # Return hit status (0 or 1)
           cmd << ' l' if return_last_access # Return seconds since last access
           cmd << ' u' if skip_lru_bump # Don't bump LRU or update access stats
@@ -61,7 +62,7 @@ module Dalli
           cmd << ' b' if base64
           cmd << " F#{bitflags}" if bitflags
           cmd << cas_string(cas)
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << " M#{mode_to_token(mode)}"
           cmd << ' q' if quiet
           cmd << TERMINATOR
@@ -74,7 +75,7 @@ module Dalli
           cmd = "md #{key}"
           cmd << ' b' if base64
           cmd << cas_string(cas)
-          cmd << " T#{ttl}" if ttl
+          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
           cmd << ' I' if stale # Mark stale instead of deleting
           cmd << ' q' if quiet
           cmd + TERMINATOR
@@ -83,10 +84,10 @@ module Dalli
         def self.meta_arithmetic(key:, delta:, initial:, incr: true, cas: nil, ttl: nil, base64: false, quiet: false)
           cmd = "ma #{key} v"
           cmd << ' b' if base64
-          cmd << " D#{delta}" if delta
-          cmd << " J#{initial}" if initial
+          cmd << " D#{integer_flag(:delta, delta)}" if delta
+          cmd << " J#{integer_flag(:initial, initial)}" if initial
           # Always set a TTL if an initial value is specified
-          cmd << " N#{ttl || 0}" if ttl || initial
+          cmd << " N#{ttl ? integer_flag(:ttl, ttl) : 0}" if ttl || initial
           cmd << cas_string(cas)
           cmd << ' q' if quiet
           cmd << " M#{incr ? 'I' : 'D'}"
@@ -136,6 +137,18 @@ module Dalli
           end
         end
 
+        # Numeric flag values are written straight into the command line, so a
+        # value that isn't an integer -- e.g. a String carrying CRLF -- would let
+        # the caller inject further memcached commands (GHSA-6wmv-xq9m-fmp7).
+        # Converting to Integer means only digits ever reach the wire. Strings
+        # are parsed as base 10 so "010" means 10, as memcached would read it,
+        # rather than octal 8.
+        def self.integer_flag(name, value)
+          value.is_a?(String) ? Integer(value, 10) : Integer(value)
+        rescue ArgumentError, TypeError, FloatDomainError
+          raise ArgumentError, "#{name} must be an Integer, got #{value.inspect}"
+        end
+
         def self.cas_string(cas)
           cas = parse_to_64_bit_int(cas, nil)
           cas.nil? || cas.zero? ? '' : " C#{cas}"

data/lib/dalli/protocol/meta/response_processor.rb

@@ -175,8 +175,10 @@ module Dalli
           # We have a complete response that has no body.
           # This is either the response to the terminating
           # noop or, if the status is not MN, an intermediate
-          # error response that needs to be discarded.
-          return [header_len, true, nil, nil, nil] if body_len.zero?
+          # error response that needs to be discarded. A hit
+          # on an empty value (VA 0) still has a body -- just
+          # its terminator -- so it's parsed below as a value.
+          return [header_len, true, nil, nil, nil] if no_body?(tokens, body_len)
 
           resp_size = header_len + body_len + TERMINATOR.length
           # The header is in the buffer, but the body is not.  As we don't have
@@ -189,6 +191,11 @@ module Dalli
           full_response_from_buffer(tokens, body, resp_size)
         end
 
+        # A zero-size reply has no body unless it's a VA (a hit on an empty value)
+        def no_body?(tokens, body_len)
+          body_len.zero? && tokens.first != VA
+        end
+
         def error_on_unexpected!(expected_codes)
           tokens = next_line_to_tokens
 

data/lib/dalli/protocol/meta.rb

@@ -146,7 +146,7 @@ module Dalli
         response_processor.meta_set_with_cas unless quiet?
       end
 
-      # rubocop:disable Metrics/ParameterLists
+      # rubocop:disable-next Metrics/ParameterLists
       def write_storage_req(mode, key, raw_value, ttl = nil, cas = nil, options = {}, quiet: quiet?)
         (value, bitflags) = @value_marshaller.store(key, raw_value, options)
         ttl = TtlSanitizer.sanitize(ttl) if ttl
@@ -159,7 +159,6 @@ module Dalli
         write(TERMINATOR)
         @connection_manager.flush unless quiet
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def append(key, value)
         write_append_prepend_req(:append, key, value)
@@ -171,7 +170,7 @@ module Dalli
         response_processor.meta_set_append_prepend unless quiet?
       end
 
-      # rubocop:disable Metrics/ParameterLists
+      # rubocop:disable-next Metrics/ParameterLists
       def write_append_prepend_req(mode, key, value, ttl = nil, cas = nil, _options = {})
         ttl = TtlSanitizer.sanitize(ttl) if ttl
         encoded_key, base64 = KeyRegularizer.encode(key)
@@ -182,7 +181,6 @@ module Dalli
         write(TERMINATOR)
         @connection_manager.flush unless quiet?
       end
-      # rubocop:enable Metrics/ParameterLists
 
       # Delete Commands
       def delete(key, cas)

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '4.3.3'
+  VERSION = '4.3.5'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.4'
 end

data/lib/rack/session/dalli.rb

@@ -16,11 +16,10 @@ module Rack
       attr_reader :data
 
       # Don't freeze this until we fix the specs/implementation
-      # rubocop:disable Style/MutableConstant
+      # rubocop:disable-next Style/MutableConstant
       DEFAULT_DALLI_OPTIONS = {
         namespace: 'rack:session'
       }
-      # rubocop:enable Style/MutableConstant
 
       # Brings in a new Rack::Session::Dalli middleware with the given
       # `:memcache_server`. The server is either a hostname, or a

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 4.3.3
+  version: 4.3.5
 platform: ruby
 authors:
 - Peter M. Goldstein
@@ -93,7 +93,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.21
 specification_version: 4
 summary: High performance memcached client for Ruby
 test_files: []