puma 4.3.1-java → 4.3.3-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa5c4775b6154a8fda14a3a8dc2004cac2be0f81d1114e23a558e9d625a3eb89
-  data.tar.gz: fc66d17895f167abb2eb59a299f50880d3b4c79f80f405d2427bb8d46ed853f9
+  metadata.gz: 74024757af24c86b43fdd7360b8f8177fedfa1fb75b34f128175b16e12c4e20b
+  data.tar.gz: 708c5433d1f023d23c0eda449f62294283caafbb77fcd4250f814aa5bba1d160
 SHA512:
-  metadata.gz: f1db3eeddfcf8abd56c5d34d58a6f4f7485c435bc79036305b0ce69a0b0a5263a7ea543119c335726c368f405bb3f3c58e40206dbe4aa027a95744b136245d74
-  data.tar.gz: d2e2229abb66f44c7811be9d7ef8c771943189b9af7a9719034bf0d50cebedea819d3428b0d1d53bb4b3d7d2d1d919562c9d6e3c885fca7c2f6d9aa2b6e67152
+  metadata.gz: b9411791854d704f8be4f8df38b212cf021eb3e3c9c82c2ab71230271fb053c81219229fec9f4973f8d4cbd632b3ab9f7cace5e81c883147d7f823cfe59694a4
+  data.tar.gz: 4964f5bc6d0f921f28d7526b9313d80e7a90119fce7e74c325f3540055e7e7b797fb985d49e9a21cb8f9f04a883f0a64804e2cba364899047b261d7f55164e62

data/History.md

@@ -6,6 +6,18 @@
 * Bugfixes
   * Your bugfix goes here (#Github Number)
 
+
+## 4.3.3 and 3.12.4 / 2020-02-28
+  * Bugfixes
+    * Fix: Fixes a problem where we weren't splitting headers correctly on newlines (#2132)
+  * Security
+    * Fix: Prevent HTTP Response splitting via CR in early hints.
+
+## 4.3.2 and 3.12.3 / 2020-02-27
+
+* Security
+  * Fix: Prevent HTTP Response splitting via CR/LF in header values. CVE-2020-5247.
+
 ## 4.3.1 and 3.12.2 / 2019-12-05
 
 * Security

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.1".freeze
+    PUMA_VERSION = VERSION = "4.3.3".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -228,6 +228,7 @@ module Puma
     COLON = ": ".freeze
 
     NEWLINE = "\n".freeze
+    HTTP_INJECTION_REGEX = /[\r\n]/.freeze
 
     HIJACK_P = "rack.hijack?".freeze
     HIJACK = "rack.hijack".freeze

data/lib/puma/server.rb

@@ -657,6 +657,7 @@ module Puma
             headers.each_pair do |k, vs|
               if vs.respond_to?(:to_s) && !vs.to_s.empty?
                 vs.to_s.split(NEWLINE).each do |v|
+                  next if possible_header_injection?(v)
                   fast_write client, "#{k}: #{v}\r\n"
                 end
               else
@@ -758,6 +759,7 @@ module Puma
         headers.each do |k, vs|
           case k.downcase
           when CONTENT_LENGTH2
+            next if possible_header_injection?(vs)
             content_length = vs
             next
           when TRANSFER_ENCODING
@@ -770,6 +772,7 @@ module Puma
 
           if vs.respond_to?(:to_s) && !vs.to_s.empty?
             vs.to_s.split(NEWLINE).each do |v|
+              next if possible_header_injection?(v)
               lines.append k, colon, v, line_ending
             end
           else
@@ -1040,5 +1043,10 @@ module Puma
     def shutting_down?
       @status == :stop || @status == :restart
     end
+
+    def possible_header_injection?(header_value)
+      HTTP_INJECTION_REGEX =~ header_value.to_s
+    end
+    private :possible_header_injection?
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 4.3.1
+  version: 4.3.3
 platform: java
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-12-05 00:00:00.000000000 Z
+date: 2020-02-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -17,8 +17,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
   name: nio4r
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"