puma 4.3.0-java → 4.3.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e6d09366b4b771a3942466e98d52d3af9a879420e1debed767b53eaa4edaf36
-  data.tar.gz: 6f1ae43b69087282ec3c11519c0d64613180d4655a7f2d4c93a13a0856e2b99a
+  metadata.gz: aa5c4775b6154a8fda14a3a8dc2004cac2be0f81d1114e23a558e9d625a3eb89
+  data.tar.gz: fc66d17895f167abb2eb59a299f50880d3b4c79f80f405d2427bb8d46ed853f9
 SHA512:
-  metadata.gz: 761970dd43e44b0f58d87129eb9c94921bdc073942ab8f351de9afea5ee471daf1ff94fe101e4e04e71988738b55b56f2bc035eba9274eb763b4071c19e5514b
-  data.tar.gz: ac47fae97e259a53e76c4153da10d2cccedee210c17bdabcffcbf585e78c8cf3eb5efcca55c87ec8218b5455a37f90421a97f8592192bbc6e4d611f90b01e082
+  metadata.gz: f1db3eeddfcf8abd56c5d34d58a6f4f7485c435bc79036305b0ce69a0b0a5263a7ea543119c335726c368f405bb3f3c58e40206dbe4aa027a95744b136245d74
+  data.tar.gz: d2e2229abb66f44c7811be9d7ef8c771943189b9af7a9719034bf0d50cebedea819d3428b0d1d53bb4b3d7d2d1d919562c9d6e3c885fca7c2f6d9aa2b6e67152

data/History.md

@@ -6,6 +6,11 @@
 * Bugfixes
   * Your bugfix goes here (#Github Number)
 
+## 4.3.1 and 3.12.2 / 2019-12-05
+
+* Security
+  * Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770.
+
 ## 4.3.0 / 2019-11-07
 
 * Features

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.0".freeze
+    PUMA_VERSION = VERSION = "4.3.1".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -118,6 +118,13 @@ module Puma
     # sending data back
     WRITE_TIMEOUT = 10
 
+    # How many requests to attempt inline before sending a client back to
+    # the reactor to be subject to normal ordering. The idea here is that
+    # we amortize the cost of going back to the reactor for a well behaved
+    # but very "greedy" client across 10 requests. This prevents a not
+    # well behaved client from monopolizing the thread forever.
+    MAX_FAST_INLINE = 10
+
     # The original URI requested by the client.
     REQUEST_URI= 'REQUEST_URI'.freeze
     REQUEST_PATH = 'REQUEST_PATH'.freeze

data/lib/puma/server.rb

@@ -466,6 +466,8 @@ module Puma
         clean_thread_locals = @options[:clean_thread_locals]
         close_socket = true
 
+        requests = 0
+
         while true
           case handle_request(client, buffer)
           when false
@@ -479,7 +481,19 @@ module Puma
 
             ThreadPool.clean_thread_locals if clean_thread_locals
 
-            unless client.reset(@status == :run)
+            requests += 1
+
+            check_for_more_data = @status == :run
+
+            if requests >= MAX_FAST_INLINE
+              # This will mean that reset will only try to use the data it already
+              # has buffered and won't try to read more data. What this means is that
+              # every client, independent of their request speed, gets treated like a slow
+              # one once every MAX_FAST_INLINE requests.
+              check_for_more_data = false
+            end
+
+            unless client.reset(check_for_more_data)
               close_socket = false
               client.set_timeout @persistent_timeout
               @reactor.add client

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 4.3.1
 platform: java
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-11-07 00:00:00.000000000 Z
+date: 2019-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement