gitlab-exporter 11.18.1 → 11.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fe7c2d285f8033326b10311872bafcf80283f300337350c89102d612321dbcc
-  data.tar.gz: be8c7d380b690312df25f396769e179ea9e4679bdf2637463ce35fd4c1cc17e2
+  metadata.gz: 5bb85649c03d72472315136401ebb234618c2350a5e75e5f426619aed2c97286
+  data.tar.gz: f0f0f46b1cbfea992e7b171ed7a1877af7c232a5e0e1a549666d5086d8e72087
 SHA512:
-  metadata.gz: 25e35175c9d62b39eebd55f8db1d09ad602a8762e12fea42abe88859a899f02c2245e18928a8fc94393316949752e83f04034da3665ec975edfe8e414a9c17d0
-  data.tar.gz: c20b4d64ef88f945dbf468914e1dcfce05800aa033b24bd88a22df2ef4417a53f82bad2edc3e76065d93fecf2fdddece560d65851ca8be3ee40ef6671534bc9f
+  metadata.gz: ed4f5b1dfa84d713c4c2246fa3e77ca604fe49d616d11f0ddc6cf80d1a5d87bc79f62115e4abec9e7d18ef1f50b5f6a654a329d9477464c83f3884cbb06d960f
+  data.tar.gz: c10bb0f6452deff8a9f7615a8d7379d30e1c9cc428b50b8092f5f007db87b97ac12c6567b8db75f321a0c749686329931b6fa49ab2e1e63ae335b85341b5ee7b

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-exporter (11.18.1)
+    gitlab-exporter (11.18.2)
       connection_pool (= 2.2.5)
       faraday (~> 1.8.0)
       pg (= 1.2.3)

data/lib/gitlab_exporter/rack_vulndb_255039_patch.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+if Gem.loaded_specs["rack"].version >= Gem::Version.new("3.0.0")
+  fail <<~ERR
+    This patch is unnecessary in Rack versions 3.0.0 or newer.
+    Please remove this file and the associated spec.
+
+    See https://github.com/rack/rack/blob/main/CHANGELOG.md#security (issue #1733)
+  ERR
+end
+
+# Patches a cache poisoning attack vector in Rack by not allowing semicolons
+# to delimit query parameters.
+# See https://github.com/rack/rack/issues/1732.
+#
+# Solution is taken from the same issue.
+#
+# The actual patch is due for release in Rack 3.0.0.
+module Rack
+  class Request # rubocop:disable Style/Documentation
+    Helpers.module_eval do
+      # rubocop: disable Naming/MethodName
+      def GET
+        if get_header(RACK_REQUEST_QUERY_STRING) == query_string
+          get_header(RACK_REQUEST_QUERY_HASH)
+        else
+          query_hash = parse_query(query_string, "&") # only allow ampersand here
+          set_header(RACK_REQUEST_QUERY_STRING, query_string)
+          set_header(RACK_REQUEST_QUERY_HASH, query_hash)
+        end
+      end
+      # rubocop: enable Naming/MethodName
+    end
+  end
+end

data/lib/gitlab_exporter/version.rb

@@ -1,5 +1,5 @@
 module GitLab
   module Exporter
-    VERSION = "11.18.1".freeze
+    VERSION = "11.18.2".freeze
   end
 end

data/lib/gitlab_exporter/web_exporter.rb

@@ -2,6 +2,7 @@ require "sinatra/base"
 require "English"
 require "cgi"
 
+require_relative "rack_vulndb_255039_patch"
 require_relative "tls_helper"
 
 module GitLab

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-exporter
 version: !ruby/object:Gem::Version
-  version: 11.18.1
+  version: 11.18.2
 platform: ruby
 authors:
 - Pablo Carranza
@@ -202,6 +202,7 @@ files:
 - lib/gitlab_exporter/prober.rb
 - lib/gitlab_exporter/process.rb
 - lib/gitlab_exporter/prometheus.rb
+- lib/gitlab_exporter/rack_vulndb_255039_patch.rb
 - lib/gitlab_exporter/ruby.rb
 - lib/gitlab_exporter/sidekiq.rb
 - lib/gitlab_exporter/tls_helper.rb