puma 3.12.2 → 3.12.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8483f2a5087645c3b4a3f066a9ad804849c9c81d9df9c50ee17cc5a6594071bb
-  data.tar.gz: aee48433624d9efaeafe08c7747a38e8fd843645861ae82b3e2d8c59f1b7ecb5
+  metadata.gz: 90c787c1348aac4bd79f044a1d8a7014c21a5bf2367bb6362ab7aad7149aad0b
+  data.tar.gz: e1f3c2988248be7b1fe505589d9062939c01fc5a98436dfde40a5c4fe797716f
 SHA512:
-  metadata.gz: 95aa82dbc1af85a87975c27f5061ccd55349950e3d17336ad62271788601821f835dc53b9f8542d008de0d6f7f4fc8b128a89cf5300488016f573c34e319ee62
-  data.tar.gz: e4e97b12c6c3d285fb327201760f2ffcd80dd716f67b52aee02670940d141832ba28044ddfda969df173ebe9bbe1b58068714e6308897d62d308ee6daebe3f29
+  metadata.gz: 2f4007051eecb452c7afa81869d521433a42dd5b05032fb348603086ce07912b482f03fa0073bef75103c3d1c1676836fb2816373750cff4097969b0f7b92da5
+  data.tar.gz: 4932f28317bb3100de12e531dbc00e4e944357cce687a56034c8d08919cf137050f22ce288015449a8b1123a51b61820d932df77b57d6aeda6101526b271de47

data/History.md

@@ -4,6 +4,18 @@
 
 * x bugfixes
 
+
+## 4.3.3 and 3.12.4 / 2020-02-28
+  * Bugfixes
+    * Fix: Fixes a problem where we weren't splitting headers correctly on newlines (#2132)
+  * Security
+    * Fix: Prevent HTTP Response splitting via CR in early hints.
+
+## 4.3.2 and 3.12.3 / 2020-02-27
+
+* Security
+  * Fix: Prevent HTTP Response splitting via CR/LF in header values. CVE-2020-5247.
+
 ## 4.3.1 and 3.12.2 / 2019-12-05
 
 * Security

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "3.12.2".freeze
+    PUMA_VERSION = VERSION = "3.12.4".freeze
     CODE_NAME = "Llamas in Pajamas".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -228,6 +228,7 @@ module Puma
     COLON = ": ".freeze
 
     NEWLINE = "\n".freeze
+    HTTP_INJECTION_REGEX = /[\r\n]/.freeze
 
     HIJACK_P = "rack.hijack?".freeze
     HIJACK = "rack.hijack".freeze

data/lib/puma/server.rb

@@ -653,6 +653,7 @@ module Puma
           headers.each_pair do |k, vs|
             if vs.respond_to?(:to_s) && !vs.to_s.empty?
               vs.to_s.split(NEWLINE).each do |v|
+                next if possible_header_injection?(v)
                 fast_write client, "#{k}: #{v}\r\n"
               end
             else
@@ -751,6 +752,7 @@ module Puma
         headers.each do |k, vs|
           case k.downcase
           when CONTENT_LENGTH2
+            next if possible_header_injection?(vs)
             content_length = vs
             next
           when TRANSFER_ENCODING
@@ -763,6 +765,7 @@ module Puma
 
           if vs.respond_to?(:to_s) && !vs.to_s.empty?
             vs.to_s.split(NEWLINE).each do |v|
+              next if possible_header_injection?(v)
               lines.append k, colon, v, line_ending
             end
           else
@@ -1029,5 +1032,10 @@ module Puma
     def shutting_down?
       @status == :stop || @status == :restart
     end
+
+    def possible_header_injection?(header_value)
+      HTTP_INJECTION_REGEX =~ header_value.to_s
+    end
+    private :possible_header_injection?
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 3.12.2
+  version: 3.12.4
 platform: ruby
 authors:
 - Evan Phoenix
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-12-05 00:00:00.000000000 Z
+date: 2020-02-28 00:00:00.000000000 Z
 dependencies: []
 description: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server
   for Ruby/Rack applications. Puma is intended for use in both development and production
@@ -108,7 +108,7 @@ licenses:
 - BSD-3-Clause
 metadata:
   msys2_mingw_dependencies: openssl
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -123,8 +123,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.0.6
+signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for
   Ruby/Rack applications