mongrel 1.1.3-java → 1.1.4-java

Sign up to get free protection for your applications and to get access to all the features.
data.tar.gz.sig CHANGED
@@ -1 +1,4 @@
1
- ���n�@�@݇ϖU0� H�f&ΪRY�.5jr[�r���$=o��M �ֹ�(�J�'P���Q0��d>��"L��N���0}�`OѬ')cE>T;wx��O[G��)ـ����iU'�r뱠}Fk�׵���k͍0��=IO�Ӎ�Q����:"�ܾ�'�����#D�I-�D���V����v;/}��V��ȧZ>�`Ԟ��r�1D�v�'aY8����*d�g�m�i�O�_�g�
1
+ H>AI���z�"�
2
+ �CqU@�s���軶�ѩ�c���j�z�\�_�b�\���}�̤���:�
3
+ ����D�g$\�J��`�Z���HƊ�4�X��
4
+ �i��<���v�b
data/CHANGELOG CHANGED
@@ -1,4 +1,6 @@
1
1
 
2
+ v1.1.4. Fix camping handler. Correct treatment of @throttle parameter.
3
+
2
4
  v1.1.3. Fix security flaw of DirHandler; reported on mailing list.
3
5
 
4
6
  v1.1.2. Fix worker termination bug; fix JRuby 1.0.3 load order issue; fix require issue on systems without Rubygems.
@@ -384,7 +384,7 @@ void Init_http11()
384
384
  DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
385
385
  DEF_GLOBAL(server_protocol_value, "HTTP/1.1");
386
386
  DEF_GLOBAL(http_host, "HTTP_HOST");
387
- DEF_GLOBAL(mongrel_version, "Mongrel 1.1.3"); /* XXX Why is this defined here? */
387
+ DEF_GLOBAL(mongrel_version, "Mongrel 1.1.4"); /* XXX Why is this defined here? */
388
388
  DEF_GLOBAL(server_software, "SERVER_SOFTWARE");
389
389
  DEF_GLOBAL(port_80, "80");
390
390
 
@@ -215,7 +215,7 @@ public class Http11 extends RubyObject {
215
215
 
216
216
  req.setInstanceVariable("@http_body", RubyString.newString(runtime, new ByteList(hp.parser.buffer, at, length)));
217
217
  req.aset(runtime.newString("SERVER_PROTOCOL"),runtime.newString("HTTP/1.1"));
218
- req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.3"));
218
+ req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.4"));
219
219
  }
220
220
  };
221
221
 
Binary file
@@ -96,7 +96,7 @@ module Mongrel
96
96
  @host = host
97
97
  @port = port
98
98
  @workers = ThreadGroup.new
99
- @throttle = throttle
99
+ @throttle = throttle / 100.0
100
100
  @num_processors = num_processors
101
101
  @timeout = timeout
102
102
  end
@@ -286,7 +286,7 @@ module Mongrel
286
286
  thread[:started_on] = Time.now
287
287
  @workers.add(thread)
288
288
 
289
- sleep @throttle/100.0 if @throttle > 0
289
+ sleep @throttle if @throttle > 0
290
290
  end
291
291
  rescue StopServer
292
292
  break
@@ -65,7 +65,7 @@ module Mongrel
65
65
  REQUEST_URI='REQUEST_URI'.freeze
66
66
  REQUEST_PATH='REQUEST_PATH'.freeze
67
67
 
68
- MONGREL_VERSION="1.1.3".freeze
68
+ MONGREL_VERSION="1.1.4".freeze
69
69
 
70
70
  MONGREL_TMP_BASE="mongrel".freeze
71
71
 
@@ -8,7 +8,6 @@ require 'mongrel/stats'
8
8
  require 'zlib'
9
9
  require 'yaml'
10
10
 
11
-
12
11
  module Mongrel
13
12
 
14
13
  # You implement your application handler with this. It's very light giving
@@ -102,7 +101,8 @@ module Mongrel
102
101
  #
103
102
  # If you pass nil as the root path, it will not check any locations or
104
103
  # expand any paths. This lets you serve files from multiple drives
105
- # on win32.
104
+ # on win32. It should probably not be used in a public-facing way
105
+ # without additional checks.
106
106
  #
107
107
  # The default content type is "text/plain; charset=ISO-8859-1" but you
108
108
  # can change it anything you want using the DirHandler.default_content_type
@@ -120,7 +120,7 @@ module Mongrel
120
120
  # You give it the path to the directory root and and optional listing_allowed and index_html
121
121
  def initialize(path, listing_allowed=true, index_html="index.html")
122
122
  @path = File.expand_path(path) if path
123
- @listing_allowed=listing_allowed
123
+ @listing_allowed = listing_allowed
124
124
  @index_html = index_html
125
125
  @default_content_type = "application/octet-stream".freeze
126
126
  end
@@ -132,12 +132,8 @@ module Mongrel
132
132
  # Add the drive letter or root path
133
133
  req_path = File.join(@path, req_path) if @path
134
134
  req_path = File.expand_path req_path
135
-
136
- # do not remove the check for @path at the beginning, it's what prevents
137
- # the serving of arbitrary files (and good programmer Rule #1 Says: If
138
- # you don't understand something, it's not because I'm stupid, it's
139
- # because you are).
140
- if req_path.index(@path) == 0 and File.exist? req_path
135
+
136
+ if File.exist? req_path and (!@path or req_path.index(@path) == 0)
141
137
  # It exists and it's in the right location
142
138
  if File.directory? req_path
143
139
  # The request is for a directory
@@ -157,7 +153,7 @@ module Mongrel
157
153
  return req_path
158
154
  end
159
155
  else
160
- # does not exist or isn't in the right spot or isn't valid because not start with @path
156
+ # does not exist or isn't in the right spot
161
157
  return nil
162
158
  end
163
159
  end
@@ -1,17 +1,17 @@
1
1
 
2
- # Gem::Specification for Mongrel-1.1.3
2
+ # Gem::Specification for Mongrel-1.1.4
3
3
  # Originally generated by Echoe
4
4
 
5
5
  Gem::Specification.new do |s|
6
6
  s.name = %q{mongrel}
7
- s.version = "1.1.3"
7
+ s.version = "1.1.4"
8
8
  s.platform = %q{java}
9
9
 
10
10
  s.specification_version = 2 if s.respond_to? :specification_version=
11
11
 
12
12
  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
13
13
  s.authors = ["Zed A. Shaw"]
14
- s.date = %q{2008-01-02}
14
+ s.date = %q{2008-02-29}
15
15
  s.default_executable = %q{mongrel_rails}
16
16
  s.description = %q{A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.}
17
17
  s.email = %q{}
@@ -39,9 +39,10 @@ end
39
39
  # e = Echoe.new("mongrel") do |p|
40
40
  # p.summary = "A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps."
41
41
  # p.author ="Zed A. Shaw"
42
- # p.clean_pattern = ['ext/http11/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'lib/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'ext/http11/Makefile', 'pkg', 'lib/*.bundle', '*.gem', 'site/output', '.config', 'lib/http11.jar', 'ext/http11_java/classes', 'coverage']
42
+ # p.clean_pattern = ['ext/http11/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'lib/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'ext/http11/Makefile', 'pkg', 'lib/*.bundle', '*.gem', 'site/output', '.config', 'lib/http11.jar', 'ext/http11_java/classes', 'coverage', 'doc']
43
43
  # p.url = "http://mongrel.rubyforge.org"
44
44
  # p.rdoc_pattern = ['README', 'LICENSE', 'CHANGELOG', 'COPYING', 'lib/**/*.rb', 'doc/**/*.rdoc']
45
+ # p.docs_host = 'mongrel.cloudbur.st:/home/eweaver/www/mongrel/htdocs/web'
45
46
  # p.ignore_pattern = /^(pkg|site|projects|doc|log)|CVS|\.log/
46
47
  # p.ruby_version = '>=1.8.4'
47
48
  # p.dependencies = ['gem_plugin >=0.2.3']
@@ -222,44 +223,8 @@ end
222
223
  # #### Site upload tasks
223
224
  #
224
225
  # namespace :site do
225
- #
226
- # desc "Package and upload .gem files and .tgz files for Mongrel and all subprojects to http://mongrel.rubyforge.org/releases/"
227
- # task :source => [:package_all] do
228
- # rm_rf "pkg/gems"
229
- # rm_rf "pkg/tars"
230
- # mkdir_p "pkg/gems"
231
- # mkdir_p "pkg/tars"
232
- #
233
- # FileList["**/*.gem"].each { |gem| mv gem, "pkg/gems" }
234
- # FileList["**/*.tgz"].each {|tgz| mv tgz, "pkg/tars" }
235
- #
236
- # sh "rm -rf pkg/mongrel*"
237
- # sh "gem generate_index -d pkg"
238
- # sh "scp -r CHANGELOG pkg/* rubyforge.org:/var/www/gforge-projects/mongrel/releases/"
239
- # sh "svn log -v > SVN_LOG"
240
- # sh "scp -r SVN_LOG pkg/* rubyforge.org:/var/www/gforge-projects/mongrel/releases/"
241
- # rm "SVN_LOG"
242
- # end
243
- #
244
- # desc "Upload the website"
245
- # task :web do
246
- # # Requires the 'webgem' gem
247
- # sh "cd site; webgen; webgen; curl 'http://feed43.com/mongrel.xml' > output/rss.xml; rsync -azv --no-perms --no-times output/* rubyforge.org:/var/www/gforge-projects/mongrel/"
248
- # puts "\nMake sure to re-run the site update 6 hours later if you updated the news. This delay is required for Feed43 to pick up the site changes."
249
- # end
250
- #
251
- # desc "Upload the rdocs"
252
- # task :rdoc => [:doc] do
253
- # sh "rsync -azv --no-perms --no-times doc/* rubyforge.org:/var/www/gforge-projects/mongrel/rdoc/"
254
- # sh "cd projects/gem_plugin; rake site:rdoc"
255
- # end
256
- #
257
226
  # desc "Upload the coverage report"
258
227
  # task :coverage => [:rcov] do
259
- # sh "rsync -azv --no-perms --no-times test/coverage/* rubyforge.org:/var/www/gforge-projects/mongrel/coverage/" rescue nil
228
+ # sh "rsync -azv --no-perms --no-times test/coverage/* mongrel.cloudbur.st:/home/eweaver/www/mongrel/htdocs/web/coverage" rescue nil
260
229
  # end
261
- #
262
- # desc "Upload the website, the rdocs, and the coverage report"
263
- # task :all => [:clean, :web, :rdoc, :coverage]
264
- #
265
230
  # end
@@ -49,11 +49,17 @@ class HandlersTest < Test::Unit::TestCase
49
49
  uri "/relative", :handler => Mongrel::DirHandler.new(nil, listing_allowed=false, index_html="none")
50
50
  end
51
51
  end
52
+
53
+ File.open("/tmp/testfile", 'w') do
54
+ # Do nothing
55
+ end
56
+
52
57
  @config.run
53
58
  end
54
59
 
55
60
  def teardown
56
61
  @config.stop(false, true)
62
+ File.delete "/tmp/testfile"
57
63
  end
58
64
 
59
65
  def test_more_web_server
@@ -66,14 +72,28 @@ class HandlersTest < Test::Unit::TestCase
66
72
  "http://localhost:9998/files_nodir/rdoc/",
67
73
  "http://localhost:9998/status",
68
74
  ])
69
-
70
- # XXX This can't possibly have good coverage.
71
75
  check_status res, String
72
76
  end
77
+
78
+ def test_nil_dirhandler
79
+ # Camping uses this internally
80
+ handler = Mongrel::DirHandler.new(nil, false)
81
+ assert handler.can_serve("/tmp/testfile")
82
+ # Not a bug! A nil @file parameter is the only circumstance under which
83
+ # we are allowed to serve any existing file
84
+ assert handler.can_serve("../../../../../../../../../../tmp/testfile")
85
+ end
86
+
87
+ def test_non_nil_dirhandler_is_not_vulnerable_to_path_traversal
88
+ # The famous security bug of Mongrel 1.1.2
89
+ handler = Mongrel::DirHandler.new("/doc", false)
90
+ assert_nil handler.can_serve("/tmp/testfile")
91
+ assert_nil handler.can_serve("../../../../../../../../../../tmp/testfile")
92
+ end
73
93
 
74
94
  def test_deflate
75
95
  Net::HTTP.start("localhost", 9998) do |h|
76
- # test that no accept-encoding returns a non-deflated response
96
+ # Test that no accept-encoding returns a non-deflated response
77
97
  req = h.get("/dumb")
78
98
  assert(
79
99
  !req['Content-Encoding'] ||
@@ -94,7 +94,7 @@ class WebServerTest < Test::Unit::TestCase
94
94
 
95
95
  def test_num_processors_overload
96
96
  redirect_test_io do
97
- assert_raises Errno::ECONNRESET, Errno::EPIPE, Errno::ECONNABORTED, Errno::EINVAL do
97
+ assert_raises Errno::ECONNRESET, Errno::EPIPE, Errno::ECONNABORTED, Errno::EINVAL, IOError do
98
98
  tests = [
99
99
  Thread.new { do_test(@valid_request, 1) },
100
100
  Thread.new { do_test(@valid_request, 10) },
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mongrel
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.3
4
+ version: 1.1.4
5
5
  platform: java
6
6
  authors:
7
7
  - Zed A. Shaw
@@ -52,7 +52,7 @@ cert_chain:
52
52
  ALN3mi/9z0Mf1YroliUgF0v5Yw==
53
53
  -----END CERTIFICATE-----
54
54
 
55
- date: 2008-01-02 00:00:00 -05:00
55
+ date: 2008-02-29 00:00:00 -05:00
56
56
  default_executable:
57
57
  dependencies:
58
58
  - !ruby/object:Gem::Dependency
metadata.gz.sig CHANGED
Binary file