dragonfly 1.4.1 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53b6c0b281a6030e69614429aa17a2f7e86e0037bffa2b7346e37c950444c563
-  data.tar.gz: 101cc564359bef667df565eec4ee6a8e4d00aad2f2f792c8cf0313e939ebfa67
+  metadata.gz: a21082636a15ad436d2ee93b887de5347733de38d670411c7aabb084afee9f7f
+  data.tar.gz: cc68822a3c32077c576fed5ca215952983af2e49038103c661ea95ef8a3703b7
 SHA512:
-  metadata.gz: 1afbcdd97912f2ec6bf7ba49261f885e0ddf0c4df16b1fd8b76824d6a87e1dca3be024fe666f7eb961269017f5af841aaaebe4bb7c21396f0f15db76fc7791ed
-  data.tar.gz: f26309d103bc2101287cf5e9c5cf9915defe5072275ea36b9b3cc1fa579a34c84723b48244c3ede6d49dbad71915b2267840077401a67bb8a1b585e1cc8edb66
+  metadata.gz: 80e0fb82c3d0b3551da0036e7e19a688aa94a0525b4128139f1e4f288f18ff73427e556ff49a84b7165dfdbd600648469a1f6ac135603f75f538472ddc84863b
+  data.tar.gz: 6514c3a64cbffd11cad972dc8d2aeabe39da7a9bc4744b20743703d70f34e9e7a3fb3a67198bbbd001a86073f546e89f55684083c48b098b512229846a5ab9e1

data/Gemfile

@@ -5,4 +5,10 @@ gemspec
 group :development do
   gem 'pry'
   gem 'rake'
+  # No longer in the standard library as of ruby 4.0
+  # (needed by rack/mock and activerecord respectively)
+  gem 'cgi'
+  gem 'benchmark'
+  # Needed by irb, and no longer a default gem as of ruby 4.0
+  gem 'rdoc'
 end

data/History.md

@@ -1,3 +1,9 @@
+# 1.4.2 (2026-07-21)
+
+## Fixes
+
+- Security fix for CRLF filename header injection in servers that don't sanitize
+
 # 1.4.1 (2025-01-03)
 
 ## Fixes

data/README.md

@@ -47,7 +47,7 @@ Installation
 
 or in your Gemfile
 ```ruby
-gem 'dragonfly', '~> 1.4.0'
+gem 'dragonfly', '~> 1.4.2'
 ```
 
 Require with

data/lib/dragonfly/response.rb

@@ -99,7 +99,8 @@ module Dragonfly
 
     def filename_string
       return unless job.name
-      filename = request_from_msie? ? CGI.escape(job.name) : job.name
+      name = job.name.gsub(/[\r\n]/, "")
+      filename = request_from_msie? ? CGI.escape(name) : name
       %(filename="#{filename}")
     end
 

data/lib/dragonfly/version.rb

@@ -1,3 +1,3 @@
 module Dragonfly
-  VERSION = "1.4.1"
+  VERSION = "1.4.2"
 end

data/spec/dragonfly/job_endpoint_spec.rb

@@ -109,6 +109,12 @@ describe Dragonfly::JobEndpoint do
       response = make_request(@job, 'HTTP_USER_AGENT' => "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; el-GR)")
       response['content-disposition'].should == 'filename="g%C3%BCng.txt"'
     end
+
+    it "doesn't allow \\r or \\n characters" do
+      @job.name = "\nthis\nis\r\na\n\rbad\rone\r.txt"
+      response = make_request(@job)
+      response['content-disposition'].should == 'filename="thisisabadone.txt"'
+    end
   end
 
   describe "logging" do

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dragonfly
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.4.2
 platform: ruby
 authors:
 - Mark Evans
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-03 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -285,7 +284,6 @@ homepage: http://github.com/markevans/dragonfly
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -300,8 +298,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Ideal gem for handling attachments in Rails, Sinatra and Rack applications.
 test_files: