puma 4.3.8 → 4.3.9

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of puma might be problematic. Click here for more details.

Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/History.md +5 -0
  3. data/ext/puma_http11/http11_parser.c +19 -12
  4. data/ext/puma_http11/http11_parser_common.rl +1 -1
  5. data/ext/puma_http11/org/jruby/puma/Http11Parser.java +34 -34
  6. data/lib/puma/const.rb +1 -1
  7. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 0133cf43153c495af4daa489fd6db234a14fb0d7b72201b71260d4d57dfb1211
4
- data.tar.gz: a1a369772eaf8e3e0efa2931c4cdfdc1880314540c260d6c01226f4b0fd2a863
3
+ metadata.gz: 9b3570ed48d3096b14fb6fa46a835dc625900593359d6f8cdab1a8e0e5b40c94
4
+ data.tar.gz: 462479b52c688979f1cf957fa13c5c9d8e86f2390ee191641e6ed0f7c1a7011b
5
5
  SHA512:
6
- metadata.gz: 6dfe3a8aa4e40676eb2c70822dac050c75f9bf9ec5270626e2b282a5971f323b2661d5792a4d24982e236f378a13ddf8408080e18bf7f4957cfd5971a7d8d034
7
- data.tar.gz: 95706c08d6b746d82af99474001664b282bf760fbbef14860b5e6897dd4eaedc3f4b49a5da2a1809dcfcf0a23fe5f62baabe5da88c631c8228889c615248fe03
6
+ metadata.gz: 4708cdd8122a6467559f623b16d6628809895d920a8ebae9cb14aedee0423aff6b199f6c917b1b8f7d18013f0520aa035a15b68cdde27c502534fe84348f2918
7
+ data.tar.gz: fce13221ceef9fc7b2539138de5058dc7d9e031a846ea6ff0a41978d961c282a960071d7d9d644d159d7fa1ac197d40b1cba0c31143da128c356e8ec5ccf6d49
data/History.md CHANGED
@@ -1,3 +1,8 @@
1
+ ## 4.3.9 / 2021-10-12
2
+
3
+ * Security
4
+ * Do not allow LF as a line ending in a header (CVE-2021-41136)
5
+
1
6
  ## 4.3.8 / 2021-05-11
2
7
 
3
8
  * Security
data/ext/puma_http11/http11_parser.c CHANGED
@@ -428,10 +428,13 @@ st18:
428
428
  case 18:
429
429
  #line 428 "ext/puma_http11/http11_parser.c"
430
430
  switch( (*p) ) {
431
+ case 9: goto tr25;
431
432
  case 13: goto tr26;
432
433
  case 32: goto tr27;
433
434
  }
434
- goto tr25;
435
+ if ( 33 <= (*p) && (*p) <= 126 )
436
+ goto tr25;
437
+ goto st0;
435
438
  tr25:
436
439
  #line 44 "ext/puma_http11/http11_parser.rl"
437
440
  { MARK(mark, p); }
@@ -440,10 +443,14 @@ st19:
440
443
  if ( ++p == pe )
441
444
  goto _test_eof19;
442
445
  case 19:
443
- #line 442 "ext/puma_http11/http11_parser.c"
444
- if ( (*p) == 13 )
445
- goto tr29;
446
- goto st19;
446
+ #line 445 "ext/puma_http11/http11_parser.c"
447
+ switch( (*p) ) {
448
+ case 9: goto st19;
449
+ case 13: goto tr29;
450
+ }
451
+ if ( 32 <= (*p) && (*p) <= 126 )
452
+ goto st19;
453
+ goto st0;
447
454
  tr9:
448
455
  #line 51 "ext/puma_http11/http11_parser.rl"
449
456
  {
@@ -486,7 +493,7 @@ st20:
486
493
  if ( ++p == pe )
487
494
  goto _test_eof20;
488
495
  case 20:
489
- #line 488 "ext/puma_http11/http11_parser.c"
496
+ #line 495 "ext/puma_http11/http11_parser.c"
490
497
  switch( (*p) ) {
491
498
  case 32: goto tr31;
492
499
  case 60: goto st0;
@@ -507,7 +514,7 @@ st21:
507
514
  if ( ++p == pe )
508
515
  goto _test_eof21;
509
516
  case 21:
510
- #line 509 "ext/puma_http11/http11_parser.c"
517
+ #line 516 "ext/puma_http11/http11_parser.c"
511
518
  switch( (*p) ) {
512
519
  case 32: goto tr33;
513
520
  case 60: goto st0;
@@ -528,7 +535,7 @@ st22:
528
535
  if ( ++p == pe )
529
536
  goto _test_eof22;
530
537
  case 22:
531
- #line 530 "ext/puma_http11/http11_parser.c"
538
+ #line 537 "ext/puma_http11/http11_parser.c"
532
539
  switch( (*p) ) {
533
540
  case 43: goto st22;
534
541
  case 58: goto st23;
@@ -553,7 +560,7 @@ st23:
553
560
  if ( ++p == pe )
554
561
  goto _test_eof23;
555
562
  case 23:
556
- #line 555 "ext/puma_http11/http11_parser.c"
563
+ #line 562 "ext/puma_http11/http11_parser.c"
557
564
  switch( (*p) ) {
558
565
  case 32: goto tr8;
559
566
  case 34: goto st0;
@@ -573,7 +580,7 @@ st24:
573
580
  if ( ++p == pe )
574
581
  goto _test_eof24;
575
582
  case 24:
576
- #line 575 "ext/puma_http11/http11_parser.c"
583
+ #line 582 "ext/puma_http11/http11_parser.c"
577
584
  switch( (*p) ) {
578
585
  case 32: goto tr37;
579
586
  case 34: goto st0;
@@ -596,7 +603,7 @@ st25:
596
603
  if ( ++p == pe )
597
604
  goto _test_eof25;
598
605
  case 25:
599
- #line 598 "ext/puma_http11/http11_parser.c"
606
+ #line 605 "ext/puma_http11/http11_parser.c"
600
607
  switch( (*p) ) {
601
608
  case 32: goto tr41;
602
609
  case 34: goto st0;
@@ -616,7 +623,7 @@ st26:
616
623
  if ( ++p == pe )
617
624
  goto _test_eof26;
618
625
  case 26:
619
- #line 618 "ext/puma_http11/http11_parser.c"
626
+ #line 625 "ext/puma_http11/http11_parser.c"
620
627
  switch( (*p) ) {
621
628
  case 32: goto tr44;
622
629
  case 34: goto st0;
data/ext/puma_http11/http11_parser_common.rl CHANGED
@@ -43,7 +43,7 @@
43
43
 
44
44
  field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
45
45
 
46
- field_value = any* >start_value %write_value;
46
+ field_value = ( print | "\t" )* >start_value %write_value;
47
47
 
48
48
  message_header = field_name ":" " "* field_value :> CRLF;
49
49
 
data/ext/puma_http11/org/jruby/puma/Http11Parser.java CHANGED
@@ -34,9 +34,9 @@ private static short[] init__puma_parser_key_offsets_0()
34
34
  {
35
35
  return new short [] {
36
36
  0, 0, 8, 17, 27, 29, 30, 31, 32, 33, 34, 36,
37
- 39, 41, 44, 45, 61, 62, 78, 80, 81, 89, 97, 107,
38
- 115, 124, 132, 140, 149, 158, 167, 176, 185, 194, 203, 212,
39
- 221, 230, 239, 248, 257, 266, 275, 284, 293, 302, 303
37
+ 39, 41, 44, 45, 61, 62, 78, 83, 87, 95, 103, 113,
38
+ 121, 130, 138, 146, 155, 164, 173, 182, 191, 200, 209, 218,
39
+ 227, 236, 245, 254, 263, 272, 281, 290, 299, 308, 309
40
40
  };
41
41
  }
42
42
 
@@ -52,14 +52,13 @@ private static char[] init__puma_parser_trans_keys_0()
52
52
  46, 48, 57, 48, 57, 13, 48, 57, 10, 13, 33, 124,
53
53
  126, 35, 39, 42, 43, 45, 46, 48, 57, 65, 90, 94,
54
54
  122, 10, 33, 58, 124, 126, 35, 39, 42, 43, 45, 46,
55
- 48, 57, 65, 90, 94, 122, 13, 32, 13, 32, 60, 62,
56
- 127, 0, 31, 34, 35, 32, 60, 62, 127, 0, 31, 34,
57
- 35, 43, 58, 45, 46, 48, 57, 65, 90, 97, 122, 32,
58
- 34, 35, 60, 62, 127, 0, 31, 32, 34, 35, 60, 62,
59
- 63, 127, 0, 31, 32, 34, 35, 60, 62, 127, 0, 31,
60
- 32, 34, 35, 60, 62, 127, 0, 31, 32, 36, 95, 45,
61
- 46, 48, 57, 65, 90, 32, 36, 95, 45, 46, 48, 57,
62
- 65, 90, 32, 36, 95, 45, 46, 48, 57, 65, 90, 32,
55
+ 48, 57, 65, 90, 94, 122, 9, 13, 32, 33, 126, 9,
56
+ 13, 32, 126, 32, 60, 62, 127, 0, 31, 34, 35, 32,
57
+ 60, 62, 127, 0, 31, 34, 35, 43, 58, 45, 46, 48,
58
+ 57, 65, 90, 97, 122, 32, 34, 35, 60, 62, 127, 0,
59
+ 31, 32, 34, 35, 60, 62, 63, 127, 0, 31, 32, 34,
60
+ 35, 60, 62, 127, 0, 31, 32, 34, 35, 60, 62, 127,
61
+ 0, 31, 32, 36, 95, 45, 46, 48, 57, 65, 90, 32,
63
62
  36, 95, 45, 46, 48, 57, 65, 90, 32, 36, 95, 45,
64
63
  46, 48, 57, 65, 90, 32, 36, 95, 45, 46, 48, 57,
65
64
  65, 90, 32, 36, 95, 45, 46, 48, 57, 65, 90, 32,
@@ -71,7 +70,8 @@ private static char[] init__puma_parser_trans_keys_0()
71
70
  65, 90, 32, 36, 95, 45, 46, 48, 57, 65, 90, 32,
72
71
  36, 95, 45, 46, 48, 57, 65, 90, 32, 36, 95, 45,
73
72
  46, 48, 57, 65, 90, 32, 36, 95, 45, 46, 48, 57,
74
- 65, 90, 32, 0
73
+ 65, 90, 32, 36, 95, 45, 46, 48, 57, 65, 90, 32,
74
+ 36, 95, 45, 46, 48, 57, 65, 90, 32, 0
75
75
  };
76
76
  }
77
77
 
@@ -82,7 +82,7 @@ private static byte[] init__puma_parser_single_lengths_0()
82
82
  {
83
83
  return new byte [] {
84
84
  0, 2, 3, 4, 2, 1, 1, 1, 1, 1, 0, 1,
85
- 0, 1, 1, 4, 1, 4, 2, 1, 4, 4, 2, 6,
85
+ 0, 1, 1, 4, 1, 4, 3, 2, 4, 4, 2, 6,
86
86
  7, 6, 6, 3, 3, 3, 3, 3, 3, 3, 3, 3,
87
87
  3, 3, 3, 3, 3, 3, 3, 3, 3, 1, 0
88
88
  };
@@ -95,7 +95,7 @@ private static byte[] init__puma_parser_range_lengths_0()
95
95
  {
96
96
  return new byte [] {
97
97
  0, 3, 3, 3, 0, 0, 0, 0, 0, 0, 1, 1,
98
- 1, 1, 0, 6, 0, 6, 0, 0, 2, 2, 4, 1,
98
+ 1, 1, 0, 6, 0, 6, 1, 1, 2, 2, 4, 1,
99
99
  1, 1, 1, 3, 3, 3, 3, 3, 3, 3, 3, 3,
100
100
  3, 3, 3, 3, 3, 3, 3, 3, 3, 0, 0
101
101
  };
@@ -108,9 +108,9 @@ private static short[] init__puma_parser_index_offsets_0()
108
108
  {
109
109
  return new short [] {
110
110
  0, 0, 6, 13, 21, 24, 26, 28, 30, 32, 34, 36,
111
- 39, 41, 44, 46, 57, 59, 70, 73, 75, 82, 89, 96,
112
- 104, 113, 121, 129, 136, 143, 150, 157, 164, 171, 178, 185,
113
- 192, 199, 206, 213, 220, 227, 234, 241, 248, 255, 257
111
+ 39, 41, 44, 46, 57, 59, 70, 75, 79, 86, 93, 100,
112
+ 108, 117, 125, 133, 140, 147, 154, 161, 168, 175, 182, 189,
113
+ 196, 203, 210, 217, 224, 231, 238, 245, 252, 259, 261
114
114
  };
115
115
  }
116
116
 
@@ -125,23 +125,23 @@ private static byte[] init__puma_parser_indicies_0()
125
125
  10, 1, 11, 1, 12, 1, 13, 1, 14, 1, 15, 1,
126
126
  16, 15, 1, 17, 1, 18, 17, 1, 19, 1, 20, 21,
127
127
  21, 21, 21, 21, 21, 21, 21, 21, 1, 22, 1, 23,
128
- 24, 23, 23, 23, 23, 23, 23, 23, 23, 1, 26, 27,
129
- 25, 29, 28, 30, 1, 1, 1, 1, 1, 31, 32, 1,
130
- 1, 1, 1, 1, 33, 34, 35, 34, 34, 34, 34, 1,
131
- 8, 1, 9, 1, 1, 1, 1, 35, 36, 1, 38, 1,
132
- 1, 39, 1, 1, 37, 40, 1, 42, 1, 1, 1, 1,
133
- 41, 43, 1, 45, 1, 1, 1, 1, 44, 2, 46, 46,
134
- 46, 46, 46, 1, 2, 47, 47, 47, 47, 47, 1, 2,
135
- 48, 48, 48, 48, 48, 1, 2, 49, 49, 49, 49, 49,
136
- 1, 2, 50, 50, 50, 50, 50, 1, 2, 51, 51, 51,
137
- 51, 51, 1, 2, 52, 52, 52, 52, 52, 1, 2, 53,
138
- 53, 53, 53, 53, 1, 2, 54, 54, 54, 54, 54, 1,
139
- 2, 55, 55, 55, 55, 55, 1, 2, 56, 56, 56, 56,
140
- 56, 1, 2, 57, 57, 57, 57, 57, 1, 2, 58, 58,
141
- 58, 58, 58, 1, 2, 59, 59, 59, 59, 59, 1, 2,
142
- 60, 60, 60, 60, 60, 1, 2, 61, 61, 61, 61, 61,
143
- 1, 2, 62, 62, 62, 62, 62, 1, 2, 63, 63, 63,
144
- 63, 63, 1, 2, 1, 1, 0
128
+ 24, 23, 23, 23, 23, 23, 23, 23, 23, 1, 25, 26,
129
+ 27, 25, 1, 28, 29, 28, 1, 30, 1, 1, 1, 1,
130
+ 1, 31, 32, 1, 1, 1, 1, 1, 33, 34, 35, 34,
131
+ 34, 34, 34, 1, 8, 1, 9, 1, 1, 1, 1, 35,
132
+ 36, 1, 38, 1, 1, 39, 1, 1, 37, 40, 1, 42,
133
+ 1, 1, 1, 1, 41, 43, 1, 45, 1, 1, 1, 1,
134
+ 44, 2, 46, 46, 46, 46, 46, 1, 2, 47, 47, 47,
135
+ 47, 47, 1, 2, 48, 48, 48, 48, 48, 1, 2, 49,
136
+ 49, 49, 49, 49, 1, 2, 50, 50, 50, 50, 50, 1,
137
+ 2, 51, 51, 51, 51, 51, 1, 2, 52, 52, 52, 52,
138
+ 52, 1, 2, 53, 53, 53, 53, 53, 1, 2, 54, 54,
139
+ 54, 54, 54, 1, 2, 55, 55, 55, 55, 55, 1, 2,
140
+ 56, 56, 56, 56, 56, 1, 2, 57, 57, 57, 57, 57,
141
+ 1, 2, 58, 58, 58, 58, 58, 1, 2, 59, 59, 59,
142
+ 59, 59, 1, 2, 60, 60, 60, 60, 60, 1, 2, 61,
143
+ 61, 61, 61, 61, 1, 2, 62, 62, 62, 62, 62, 1,
144
+ 2, 63, 63, 63, 63, 63, 1, 2, 1, 1, 0
145
145
  };
146
146
  }
147
147
 
data/lib/puma/const.rb CHANGED
@@ -100,7 +100,7 @@ module Puma
100
100
  # too taxing on performance.
101
101
  module Const
102
102
 
103
- PUMA_VERSION = VERSION = "4.3.8".freeze
103
+ PUMA_VERSION = VERSION = "4.3.9".freeze
104
104
  CODE_NAME = "Mysterious Traveller".freeze
105
105
  PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
106
106
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: puma
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.3.8
4
+ version: 4.3.9
5
5
  platform: ruby
6
6
  authors:
7
7
  - Evan Phoenix
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-05-11 00:00:00.000000000 Z
11
+ date: 2021-10-12 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: nio4r