puma 3.12.1-java → 3.12.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5806fb34ffd1840cdcdccc3ec1f8193affc6cfc12f6a493801836b529ca1de00
-  data.tar.gz: 3499e2b03cc6d19cd60cb38bd3f83adf61d75b8c845ac6ecb8e15c7e511a74b4
+  metadata.gz: 835d444c7e619728a20f960ff33b6d09c0ee07b5d63428ba34ce22e7408ecbfb
+  data.tar.gz: 7474d589404b47d916e134be4ed568652f029be024dfbb82c7ab404a7cb50daa
 SHA512:
-  metadata.gz: 160a9538102860ff42d698b5c0e785d7eaaabc51f3c4015a6c3bf20bf169e11357154a8972e345037864553a41da9da098de1a52e7f9a954da16145df45a97fe
-  data.tar.gz: 04a399c06144d7826da0263451b34558a28c0ea496b25de4208d36b0b5879535efa890cf849477e4c63afd53d12695d8b8e6213a736f258977f6ce180e5850d7
+  metadata.gz: 4cae9db11916b0e7838fd3949f7a71a7531ad9fb2c32f8312686a614d8f5b04a24d60b790ddca3af9c47dccad5212ba64f180d04a45d5ad47dfdb7f3c39054c5
+  data.tar.gz: 79a5ff3eb5c648690829404bc15535ae4f8082f3bdb5bc1740bbc36fdaa836fe4e32bdf7f3597b11a48a8f9ca0e98ffbb6370109747c378d2df707d90caaeadc

data/History.md

@@ -4,7 +4,12 @@
 
 * x bugfixes
 
-## 3.12.1 / 2019-01-08
+## 4.3.1 and 3.12.2 / 2019-12-05
+
+* Security
+  * Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770.
+
+## 3.12.1 / 2019-03-19
 
 * 1 features
   * Internal strings are frozen (#1649)

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "3.12.1".freeze
+    PUMA_VERSION = VERSION = "3.12.2".freeze
     CODE_NAME = "Llamas in Pajamas".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -118,6 +118,13 @@ module Puma
     # sending data back
     WRITE_TIMEOUT = 10
 
+    # How many requests to attempt inline before sending a client back to
+    # the reactor to be subject to normal ordering. The idea here is that
+    # we amortize the cost of going back to the reactor for a well behaved
+    # but very "greedy" client across 10 requests. This prevents a not
+    # well behaved client from monopolizing the thread forever.
+    MAX_FAST_INLINE = 10
+
     # The original URI requested by the client.
     REQUEST_URI= 'REQUEST_URI'.freeze
     REQUEST_PATH = 'REQUEST_PATH'.freeze

data/lib/puma/server.rb

@@ -470,6 +470,8 @@ module Puma
         clean_thread_locals = @options[:clean_thread_locals]
         close_socket = true
 
+        requests = 0
+
         while true
           case handle_request(client, buffer)
           when false
@@ -483,7 +485,19 @@ module Puma
 
             ThreadPool.clean_thread_locals if clean_thread_locals
 
-            unless client.reset(@status == :run)
+            requests += 1
+
+            check_for_more_data = @status == :run
+
+            if requests >= MAX_FAST_INLINE
+              # This will mean that reset will only try to use the data it already
+              # has buffered and won't try to read more data. What this means is that
+              # every client, independent of their request speed, gets treated like a slow
+              # one once every MAX_FAST_INLINE requests.
+              check_for_more_data = false
+            end
+
+            unless client.reset(check_for_more_data)
               close_socket = false
               client.set_timeout @persistent_timeout
               @reactor.add client

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 3.12.1
+  version: 3.12.2
 platform: java
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-03-19 00:00:00.000000000 Z
+date: 2019-12-05 00:00:00.000000000 Z
 dependencies: []
 description: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server
   for Ruby/Rack applications. Puma is intended for use in both development and production
@@ -123,8 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.7.6
+rubygems_version: 3.0.6
 signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for