pubnub 6.1.0 → 6.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71b414f7fd632778c8f35096a7dc3c8fd3c730b827ad2335df6067fd06fc24ac
-  data.tar.gz: 0d58ad506e63c4979b1c105a14062557ec5a84580ead37882896b6f8636a53e3
+  metadata.gz: 2f484475c6f9a486f2f4acb5c1882edb3a5647bd5c3fbfe2a16d521221568488
+  data.tar.gz: '09949bfd0ce89c476eb315783549e8fadde4681b3764311cf96576fb566bd79f'
 SHA512:
-  metadata.gz: eb9cf2ed6c70458c3fc4d5e784273013f362b95d5328e8c98340df39dbb2290f11376e30bce891ef47d5de576a2b9307a3cfde0e76b8bf49558e742353363c83
-  data.tar.gz: 33dcaca1439a6729e76a41eb2fb12a7ac58dc8acabace463afd035b3112aa5b8766f5a0cdeb5a095ed5d80a46408de0c2d310955506fc5efed7eb7bd3b4609f3
+  metadata.gz: 25cf31e4588c18a6458c9c2ddeb25862b02cd14339cd50ae59b3e9818adc756a05ba1bdfc9bdbaee5587469334b4633dddf9b5216552974d50d1ddebd116fcfa
+  data.tar.gz: f52d1c3fdc09ee349f25639d55844829261d514b4963e42f33b3a402cbc71f05381ea33b65216116ecc36fd6bed645827c3731b866a78c474ed7d9bb8230209f

data/.pubnub.yml

@@ -1,6 +1,15 @@
 ---
-version: "6.1.0"
+version: "6.1.1"
 changelog:
+  - date: 2026-07-21
+    version: v6.1.1
+    changes:
+      - type: bug
+        text: "`Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`."
+      - type: bug
+        text: "`Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext."
+      - type: bug
+        text: "The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values."
   - date: 2026-06-15
     version: v6.1.0
     changes:
@@ -647,7 +656,7 @@ sdks:
                     - x86-64
           - distribution-type: package
             distribution-repository: RubyGems
-            package-name: pubnub-6.1.0.gem
+            package-name: pubnub-6.1.1.gem
             location: https://rubygems.org/gems/pubnub
             requires:
               - name: addressable
@@ -752,8 +761,8 @@ sdks:
                     - x86-64
           - distribution-type: library
             distribution-repository: GitHub release
-            package-name: pubnub-6.1.0.gem
-            location: https://github.com/pubnub/ruby/releases/download/v6.1.0/pubnub-6.1.0.gem
+            package-name: pubnub-6.1.1.gem
+            location: https://github.com/pubnub/ruby/releases/download/v6.1.1/pubnub-6.1.1.gem
             requires:
               - name: addressable
                 min-version: 2.0.0

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## v6.1.1
+July 21 2026
+
+#### Fixed
+- `Pubnub::Cbor` now enforces a recursion-depth cap, a per-container length cap, and a total input size cap. Malformed or attacker-crafted tokens reaching `Pubnub::Client#parse_token` raise `Pubnub::Cbor::DecodeError` instead of hanging the caller or triggering `SystemStackError`.
+- `Pubnub::Constants::DEFAULT_SSL` flipped from `false` to `true`. Integrators must now opt out explicitly to send traffic in cleartext.
+- The Requested URI debug entry in `Pubnub::Event#uri` now masks the `signature` and `pnsig` query parameter values, per the SDK log practices ADR. `auth` and `token` remain visible at DEBUG since they are permitted URL parameters.
+
 ## v6.1.0
 June 15 2026
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    pubnub (6.1.0)
+    pubnub (6.1.1)
       addressable (>= 2.0.0)
       base64
       concurrent-ruby (~> 1.3.4)

data/VERSION

@@ -1 +1 @@
-6.1.0
+6.1.1

data/features/support/hooks.rb

@@ -12,7 +12,7 @@ Before do |scenario|
     expect(ENV['SERVER_PORT']).not_to be_nil
     @pn_configuration = {
       origin: ENV['SERVER_HOST'] + ":" + ENV['SERVER_PORT'],
-      isSecure: false,
+      ssl: false,
     }
   }
 

data/lib/pubnub/cbor.rb

@@ -1,5 +1,10 @@
 module Pubnub
   class Cbor
+    class DecodeError < StandardError; end
+
+    MAX_DEPTH = 32
+    MAX_CONTAINER_LENGTH = 65_536
+    MAX_INPUT_SIZE = 1_048_576
 
     private
 
@@ -43,9 +48,14 @@ module Pubnub
       end
     end
 
+    def take_bytes(data, count)
+      raise DecodeError, "Truncated CBOR input" if data.size < count
+      data.shift(count)
+    end
+
     def decode_integer(data, additional)
       if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
       else
         additional
       end
@@ -55,7 +65,10 @@ module Pubnub
       if additional <= 23
         additional
       else
-        bytes = bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
+        raise DecodeError, "Invalid float additional value" unless ADDITIONAL_LENGTH_BYTES.member?(additional)
+
+        bytes = bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+        
         case (additional)
         when ADDITIONAL_LENGTH_1B
           bytes
@@ -98,44 +111,57 @@ module Pubnub
       result = []
 
       loop do
+        raise DecodeError, "Truncated CBOR input" if data.empty?
         byte = data.shift
         break if byte == INDEFINITE_BREAK
         result.append(byte)
-        break if data.empty?
       end
       result
     end
 
-    def compute_length(data, additional)
-      if ADDITIONAL_LENGTH_BYTES.member?(additional)
-        bytearray_to_i(data.shift(ADDITIONAL_LENGTH_BYTES[additional]))
-      else
-        additional
+    def compute_container_length(data, additional, min_element_bytes)
+      length = if ADDITIONAL_LENGTH_BYTES.member?(additional)
+                 bytearray_to_i(take_bytes(data, ADDITIONAL_LENGTH_BYTES[additional]))
+               else
+                 additional
+               end
+
+      if length > MAX_CONTAINER_LENGTH
+        raise DecodeError, "CBOR container length #{length} exceeds maximum #{MAX_CONTAINER_LENGTH}"
+      end
+
+      if length * min_element_bytes > data.size
+        raise DecodeError, "CBOR container length #{length} exceeds remaining input"
       end
+
+      length
     end
 
     def decode_string(data, additional)
       if additional == ADDITIONAL_TYPE_INDEFINITE
         indefinite_data(data).pack('C*').force_encoding('UTF-8')
       else
-        length = compute_length(data, additional)
-        data.shift(length).pack('C*').force_encoding('UTF-8')
+        length = compute_container_length(data, additional, 1)
+        take_bytes(data, length).pack('C*').force_encoding('UTF-8')
       end
     end
 
-    def decode_map(data, additional)
-      length = compute_length(data, additional)
+    def decode_map(data, additional, depth)
+      length = compute_container_length(data, additional, 2)
       result = Hash.new
-      (1..length).each { result.store(parse_data(data), parse_data(data)) }
+      length.times { result.store(parse_data(data, depth), parse_data(data, depth)) }
       result
     end
 
-    def decode_array(data, additional)
-      length = compute_length(data, additional)
-      (1..length).map { parse_data(data) }
+    def decode_array(data, additional, depth)
+      length = compute_container_length(data, additional, 1)
+      Array.new(length) { parse_data(data, depth) }
     end
 
-    def parse_data(data)
+    def parse_data(data, depth = 0)
+      raise DecodeError, "CBOR nesting depth exceeds #{MAX_DEPTH}" if depth > MAX_DEPTH
+      raise DecodeError, "Truncated CBOR input" if data.empty?
+
       byte = data.shift
 
       case (byte)
@@ -163,9 +189,9 @@ module Pubnub
         when TYPE_TEXT_STRING
           decode_string(data, additional)
         when TYPE_ARRAY
-          decode_array(data, additional)
+          decode_array(data, additional, depth + 1)
         when TYPE_HASHMAP
-          decode_map(data, additional)
+          decode_map(data, additional, depth + 1)
         else
           nil
         end
@@ -175,7 +201,11 @@ module Pubnub
     public
 
     def decode(value)
-      parse_data(value)
+      if value.size > MAX_INPUT_SIZE
+        raise DecodeError, "CBOR input size #{value.size} exceeds maximum #{MAX_INPUT_SIZE}"
+      end
+
+      parse_data(value.dup)
     end
   end
 

data/lib/pubnub/constants.rb

@@ -20,7 +20,7 @@ module Pubnub
     DEFAULT_TTL = 1440
     DEFAULT_REGION = '0'.freeze
     DEFAULT_USE_RANDOM_IV = true
-    DEFAULT_SSL = false
+    DEFAULT_SSL = true
     REQUEST_MESSAGE_COUNT_THRESHOLD = 0
     MAXIMUM_HERE_NOW_COUNT = 1000
 

data/lib/pubnub/event.rb

@@ -88,7 +88,7 @@ module Pubnub
       uri += path
       uri += '?' + Formatter.params_hash_to_url_params(parameters)
       uri += "&signature=#{sa_signature}" if sa_signature
-      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri}" }
+      Pubnub.logger.debug('Pubnub::Event') { "Requested URI: #{uri.gsub(/([?&](?:signature|pnsig)=)[^&#]*/i, '\1***')}" }
       URI uri
     end
 

data/lib/pubnub/version.rb

@@ -1,4 +1,4 @@
 # Toplevel Pubnub module.
 module Pubnub
-  VERSION = '6.1.0'.freeze
+  VERSION = '6.1.1'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pubnub
 version: !ruby/object:Gem::Version
-  version: 6.1.0
+  version: 6.1.1
 platform: ruby
 authors:
 - PubNub
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-15 00:00:00.000000000 Z
+date: 2026-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable