grape 0.2.1 → 0.2.1.1

data/CHANGELOG.markdown

@@ -1,3 +1,7 @@
+0.2.1.1 (1/11/2013)
+====================
+* Fix: CVE-2013-0175, `multi_xml` parse vulnerability, require 'multi_xml' 0.5.2 - [@dblock](http://github.com/dblock).
+
 0.2.1 (7/11/2012)
 =================
 

data/grape.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'rack-mount'
   # s.add_runtime_dependency 'rack-jsonp'
   s.add_runtime_dependency 'multi_json'
-  s.add_runtime_dependency 'multi_xml'
+  s.add_runtime_dependency 'multi_xml', '>= 0.5.2'
   s.add_runtime_dependency 'hashie', '~> 1.2'
 
   s.add_development_dependency 'rake'

data/lib/grape/middleware/base.rb

@@ -70,6 +70,10 @@ module Grape
           PARSERS.merge(options[:parsers] || {})
         end
 
+        def content_type_for(format)
+          Hash.new(content_types)[format.to_sym]
+        end
+
         def content_types
           CONTENT_TYPES.merge(options[:content_types] || {})
         end

data/lib/grape/middleware/formatter.rb

@@ -25,11 +25,23 @@ module Grape
             parser = parser_for fmt
             unless parser.nil?
               begin
-                body = parser.call(body)
-                env['rack.request.form_hash'] = !env['rack.request.form_hash'].nil? ? env['rack.request.form_hash'].merge(body) : body
-                env['rack.request.form_input'] = env['rack.input']
-              rescue
-                # It's possible that it's just regular POST content -- just back off
+                fmt = mime_types[request.media_type] if request.media_type
+                if content_type_for(fmt)
+                  parser = parser_for fmt
+                  unless parser.nil?
+                    begin
+                      body = parser.call body
+                      env['rack.request.form_hash'] = !env['rack.request.form_hash'].nil? ? env['rack.request.form_hash'].merge(body) : body
+                      env['rack.request.form_input'] = env['rack.input']
+                    rescue
+                      # It's possible that it's just regular POST content -- just back off
+                    end
+                  end
+                else
+                  throw :error, :status => 406, :message => 'The requested content-type is not supported.'
+                end
+              ensure
+                env['rack.input'].rewind
               end
             end
             env['rack.input'].rewind

data/lib/grape/version.rb

@@ -1,3 +1,3 @@
 module Grape
-  VERSION = '0.2.1'
+  VERSION = '0.2.1.1'
 end

data/spec/grape/api_spec.rb

@@ -766,7 +766,19 @@ describe Grape::API do
       last_response.status.should eql 403
     end
   end
+  
+  context "muti_xml" do
+    it "doesn't parse yaml" do
+      subject.put :yaml do
+        params[:tag]
+      end
 
+	    expect {
+        put '/yaml', '<tag type="symbol">a123</tag>', "CONTENT_TYPE" => "application/xml"
+      }.to raise_error(MultiXml::DisallowedTypeError)
+    end
+  end
+  
   context "routes" do
     describe "empty api structure" do
       it "returns an empty array of routes" do

data/spec/spec_helper.rb

@@ -23,6 +23,5 @@ end
 
 RSpec.configure do |config|
   config.include Rack::Test::Methods
-  config.include Rack::Test::Methods::Patch
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: grape
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-07-13 00:00:00.000000000 Z
+date: 2013-01-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &70130298033500 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70130298033500
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rack-mount
-  requirement: &70130298033080 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +37,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70130298033080
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: multi_json
-  requirement: &70130298032660 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,21 +53,31 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70130298032660
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: multi_xml
-  requirement: &70130298032240 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.5.2
   type: :runtime
   prerelease: false
-  version_requirements: *70130298032240
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.5.2
 - !ruby/object:Gem::Dependency
   name: hashie
-  requirement: &70130298031740 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -65,10 +85,15 @@ dependencies:
         version: '1.2'
   type: :runtime
   prerelease: false
-  version_requirements: *70130298031740
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70130298031320 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,10 +101,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70130298031320
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: maruku
-  requirement: &70130298030860 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,10 +117,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70130298030860
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: yard
-  requirement: &70130298030440 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,10 +133,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70130298030440
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &70130298030020 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -109,10 +149,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70130298030020
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70130298029520 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -120,10 +165,15 @@ dependencies:
         version: '2.9'
   type: :development
   prerelease: false
-  version_requirements: *70130298029520
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '2.9'
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70130298029100 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -131,7 +181,12 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70130298029100
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: A Ruby framework for rapid API development with great conventions.
 email:
 - michael@intridea.com
@@ -190,7 +245,6 @@ files:
 - spec/shared/versioning_examples.rb
 - spec/spec_helper.rb
 - spec/support/basic_auth_encode_helpers.rb
-- spec/support/rack_patch.rb
 - spec/support/versioned_helpers.rb
 homepage: https://github.com/intridea/grape
 licenses:
@@ -207,7 +261,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 2226649609976967092
+      hash: 512216654996826600
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -216,10 +270,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 2226649609976967092
+      hash: 512216654996826600
 requirements: []
 rubyforge_project: grape
-rubygems_version: 1.8.10
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: A simple Ruby framework for building REST-like APIs.
@@ -244,6 +298,5 @@ test_files:
 - spec/shared/versioning_examples.rb
 - spec/spec_helper.rb
 - spec/support/basic_auth_encode_helpers.rb
-- spec/support/rack_patch.rb
 - spec/support/versioned_helpers.rb
 has_rdoc: 

data/spec/support/rack_patch.rb

@@ -1,25 +0,0 @@
-unless Rack::Test::Session.method_defined?(:patch)
-  module Rack
-    module Test
-      module Methods
-        module Patch
-          extend Forwardable
-          def_delegators :current_session, *[:patch]
-        end
-      end
-    end
-  end
-
-  module Rack
-    module Test
-      class Session
-        def patch(uri, params = {}, env = {}, &block)
-          env = env_for(uri, env.merge(:method => "PATCH", :params => params))
-          process_request(uri, env, &block)
-        end
-      end
-    end
-  end
-else
-  raise LoadError, "Remove spec/support/rack_patch.rb | rack-test #{Rack::Test::VERSION} has a method patch"
-end