puma 4.3.9 → 4.3.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b3570ed48d3096b14fb6fa46a835dc625900593359d6f8cdab1a8e0e5b40c94
-  data.tar.gz: 462479b52c688979f1cf957fa13c5c9d8e86f2390ee191641e6ed0f7c1a7011b
+  metadata.gz: f01631d0dd0843d149b6af364b95378f66e93b20ca449e8a734c445cfc74a9b9
+  data.tar.gz: 38ff0fb797898ba2981bfe201ce279400151e2c77d1741f028bcb168fe825bd8
 SHA512:
-  metadata.gz: 4708cdd8122a6467559f623b16d6628809895d920a8ebae9cb14aedee0423aff6b199f6c917b1b8f7d18013f0520aa035a15b68cdde27c502534fe84348f2918
-  data.tar.gz: fce13221ceef9fc7b2539138de5058dc7d9e031a846ea6ff0a41978d961c282a960071d7d9d644d159d7fa1ac197d40b1cba0c31143da128c356e8ec5ccf6d49
+  metadata.gz: 4f712a8da3d29f6890321a468d49bb9eb104063d6c49ea27ce58101538b1f99180bd4c7a8f96817cf20e1a42b00e8043d760126e9cc899fe335fbddeb6462f45
+  data.tar.gz: 4bf8d5bc37ab8f45452967a3bb6c4f30e712c5a73ebaf86db82367dddd4766de651410c29295c292c4bc6b06dffd042c0bf4d3f6acf4c92e0abba6a106b8e43c

data/History.md

@@ -1,3 +1,13 @@
+## 4.3.11 / 2022-02-11
+
+* Security
+  * Always close the response body (GHSA-rmj8-8hhh-gv5h)
+
+## 4.3.10 / 2021-10-12
+
+* Bugfixes
+  * Allow UTF-8 in HTTP header values
+
 ## 4.3.9 / 2021-10-12
 
 * Security

data/ext/puma_http11/http11_parser.c

@@ -428,13 +428,16 @@ st18:
 case 18:
 #line 428 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
-		case 9: goto tr25;
 		case 13: goto tr26;
 		case 32: goto tr27;
+		case 127: goto st0;
 	}
-	if ( 33 <= (*p) && (*p) <= 126 )
-		goto tr25;
-	goto st0;
+	if ( (*p) > 8 ) {
+		if ( 10 <= (*p) && (*p) <= 31 )
+			goto st0;
+	} else if ( (*p) >= 0 )
+		goto st0;
+	goto tr25;
 tr25:
 #line 44 "ext/puma_http11/http11_parser.rl"
 	{ MARK(mark, p); }
@@ -443,14 +446,17 @@ st19:
 	if ( ++p == pe )
 		goto _test_eof19;
 case 19:
-#line 445 "ext/puma_http11/http11_parser.c"
+#line 448 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
-		case 9: goto st19;
 		case 13: goto tr29;
+		case 127: goto st0;
 	}
-	if ( 32 <= (*p) && (*p) <= 126 )
-		goto st19;
-	goto st0;
+	if ( (*p) > 8 ) {
+		if ( 10 <= (*p) && (*p) <= 31 )
+			goto st0;
+	} else if ( (*p) >= 0 )
+		goto st0;
+	goto st19;
 tr9:
 #line 51 "ext/puma_http11/http11_parser.rl"
 	{
@@ -493,7 +499,7 @@ st20:
 	if ( ++p == pe )
 		goto _test_eof20;
 case 20:
-#line 495 "ext/puma_http11/http11_parser.c"
+#line 501 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr31;
 		case 60: goto st0;
@@ -514,7 +520,7 @@ st21:
 	if ( ++p == pe )
 		goto _test_eof21;
 case 21:
-#line 516 "ext/puma_http11/http11_parser.c"
+#line 522 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr33;
 		case 60: goto st0;
@@ -535,7 +541,7 @@ st22:
 	if ( ++p == pe )
 		goto _test_eof22;
 case 22:
-#line 537 "ext/puma_http11/http11_parser.c"
+#line 543 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 43: goto st22;
 		case 58: goto st23;
@@ -560,7 +566,7 @@ st23:
 	if ( ++p == pe )
 		goto _test_eof23;
 case 23:
-#line 562 "ext/puma_http11/http11_parser.c"
+#line 568 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr8;
 		case 34: goto st0;
@@ -580,7 +586,7 @@ st24:
 	if ( ++p == pe )
 		goto _test_eof24;
 case 24:
-#line 582 "ext/puma_http11/http11_parser.c"
+#line 588 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr37;
 		case 34: goto st0;
@@ -603,7 +609,7 @@ st25:
 	if ( ++p == pe )
 		goto _test_eof25;
 case 25:
-#line 605 "ext/puma_http11/http11_parser.c"
+#line 611 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr41;
 		case 34: goto st0;
@@ -623,7 +629,7 @@ st26:
 	if ( ++p == pe )
 		goto _test_eof26;
 case 26:
-#line 625 "ext/puma_http11/http11_parser.c"
+#line 631 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr44;
 		case 34: goto st0;

data/ext/puma_http11/http11_parser_common.rl

@@ -43,7 +43,7 @@
 
   field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
 
-  field_value = ( print | "\t" )* >start_value %write_value;
+  field_value = ( (any -- CTL) | "\t" )* >start_value %write_value;
 
   message_header = field_name ":" " "* field_value :> CRLF;
 

data/ext/puma_http11/org/jruby/puma/Http11Parser.java

@@ -34,9 +34,9 @@ private static short[] init__puma_parser_key_offsets_0()
 {
 	return new short [] {
 	    0,    0,    8,   17,   27,   29,   30,   31,   32,   33,   34,   36,
-	   39,   41,   44,   45,   61,   62,   78,   83,   87,   95,  103,  113,
-	  121,  130,  138,  146,  155,  164,  173,  182,  191,  200,  209,  218,
-	  227,  236,  245,  254,  263,  272,  281,  290,  299,  308,  309
+	   39,   41,   44,   45,   61,   62,   78,   85,   91,   99,  107,  117,
+	  125,  134,  142,  150,  159,  168,  177,  186,  195,  204,  213,  222,
+	  231,  240,  249,  258,  267,  276,  285,  294,  303,  312,  313
 	};
 }
 
@@ -52,26 +52,27 @@ private static char[] init__puma_parser_trans_keys_0()
 	   46,   48,   57,   48,   57,   13,   48,   57,   10,   13,   33,  124,
 	  126,   35,   39,   42,   43,   45,   46,   48,   57,   65,   90,   94,
 	  122,   10,   33,   58,  124,  126,   35,   39,   42,   43,   45,   46,
-	   48,   57,   65,   90,   94,  122,    9,   13,   32,   33,  126,    9,
-	   13,   32,  126,   32,   60,   62,  127,    0,   31,   34,   35,   32,
-	   60,   62,  127,    0,   31,   34,   35,   43,   58,   45,   46,   48,
-	   57,   65,   90,   97,  122,   32,   34,   35,   60,   62,  127,    0,
-	   31,   32,   34,   35,   60,   62,   63,  127,    0,   31,   32,   34,
-	   35,   60,   62,  127,    0,   31,   32,   34,   35,   60,   62,  127,
-	    0,   31,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,    0
+	   48,   57,   65,   90,   94,  122,   13,   32,  127,    0,    8,   10,
+	   31,   13,  127,    0,    8,   10,   31,   32,   60,   62,  127,    0,
+	   31,   34,   35,   32,   60,   62,  127,    0,   31,   34,   35,   43,
+	   58,   45,   46,   48,   57,   65,   90,   97,  122,   32,   34,   35,
+	   60,   62,  127,    0,   31,   32,   34,   35,   60,   62,   63,  127,
+	    0,   31,   32,   34,   35,   60,   62,  127,    0,   31,   32,   34,
+	   35,   60,   62,  127,    0,   31,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,    0
 	};
 }
 
@@ -95,7 +96,7 @@ private static byte[] init__puma_parser_range_lengths_0()
 {
 	return new byte [] {
 	    0,    3,    3,    3,    0,    0,    0,    0,    0,    0,    1,    1,
-	    1,    1,    0,    6,    0,    6,    1,    1,    2,    2,    4,    1,
+	    1,    1,    0,    6,    0,    6,    2,    2,    2,    2,    4,    1,
 	    1,    1,    1,    3,    3,    3,    3,    3,    3,    3,    3,    3,
 	    3,    3,    3,    3,    3,    3,    3,    3,    3,    0,    0
 	};
@@ -108,9 +109,9 @@ private static short[] init__puma_parser_index_offsets_0()
 {
 	return new short [] {
 	    0,    0,    6,   13,   21,   24,   26,   28,   30,   32,   34,   36,
-	   39,   41,   44,   46,   57,   59,   70,   75,   79,   86,   93,  100,
-	  108,  117,  125,  133,  140,  147,  154,  161,  168,  175,  182,  189,
-	  196,  203,  210,  217,  224,  231,  238,  245,  252,  259,  261
+	   39,   41,   44,   46,   57,   59,   70,   76,   81,   88,   95,  102,
+	  110,  119,  127,  135,  142,  149,  156,  163,  170,  177,  184,  191,
+	  198,  205,  212,  219,  226,  233,  240,  247,  254,  261,  263
 	};
 }
 
@@ -125,23 +126,24 @@ private static byte[] init__puma_parser_indicies_0()
 	   10,    1,   11,    1,   12,    1,   13,    1,   14,    1,   15,    1,
 	   16,   15,    1,   17,    1,   18,   17,    1,   19,    1,   20,   21,
 	   21,   21,   21,   21,   21,   21,   21,   21,    1,   22,    1,   23,
-	   24,   23,   23,   23,   23,   23,   23,   23,   23,    1,   25,   26,
-	   27,   25,    1,   28,   29,   28,    1,   30,    1,    1,    1,    1,
-	    1,   31,   32,    1,    1,    1,    1,    1,   33,   34,   35,   34,
-	   34,   34,   34,    1,    8,    1,    9,    1,    1,    1,    1,   35,
-	   36,    1,   38,    1,    1,   39,    1,    1,   37,   40,    1,   42,
-	    1,    1,    1,    1,   41,   43,    1,   45,    1,    1,    1,    1,
-	   44,    2,   46,   46,   46,   46,   46,    1,    2,   47,   47,   47,
-	   47,   47,    1,    2,   48,   48,   48,   48,   48,    1,    2,   49,
-	   49,   49,   49,   49,    1,    2,   50,   50,   50,   50,   50,    1,
-	    2,   51,   51,   51,   51,   51,    1,    2,   52,   52,   52,   52,
-	   52,    1,    2,   53,   53,   53,   53,   53,    1,    2,   54,   54,
-	   54,   54,   54,    1,    2,   55,   55,   55,   55,   55,    1,    2,
-	   56,   56,   56,   56,   56,    1,    2,   57,   57,   57,   57,   57,
-	    1,    2,   58,   58,   58,   58,   58,    1,    2,   59,   59,   59,
-	   59,   59,    1,    2,   60,   60,   60,   60,   60,    1,    2,   61,
-	   61,   61,   61,   61,    1,    2,   62,   62,   62,   62,   62,    1,
-	    2,   63,   63,   63,   63,   63,    1,    2,    1,    1,    0
+	   24,   23,   23,   23,   23,   23,   23,   23,   23,    1,   26,   27,
+	    1,    1,    1,   25,   29,    1,    1,    1,   28,   30,    1,    1,
+	    1,    1,    1,   31,   32,    1,    1,    1,    1,    1,   33,   34,
+	   35,   34,   34,   34,   34,    1,    8,    1,    9,    1,    1,    1,
+	    1,   35,   36,    1,   38,    1,    1,   39,    1,    1,   37,   40,
+	    1,   42,    1,    1,    1,    1,   41,   43,    1,   45,    1,    1,
+	    1,    1,   44,    2,   46,   46,   46,   46,   46,    1,    2,   47,
+	   47,   47,   47,   47,    1,    2,   48,   48,   48,   48,   48,    1,
+	    2,   49,   49,   49,   49,   49,    1,    2,   50,   50,   50,   50,
+	   50,    1,    2,   51,   51,   51,   51,   51,    1,    2,   52,   52,
+	   52,   52,   52,    1,    2,   53,   53,   53,   53,   53,    1,    2,
+	   54,   54,   54,   54,   54,    1,    2,   55,   55,   55,   55,   55,
+	    1,    2,   56,   56,   56,   56,   56,    1,    2,   57,   57,   57,
+	   57,   57,    1,    2,   58,   58,   58,   58,   58,    1,    2,   59,
+	   59,   59,   59,   59,    1,    2,   60,   60,   60,   60,   60,    1,
+	    2,   61,   61,   61,   61,   61,    1,    2,   62,   62,   62,   62,
+	   62,    1,    2,   63,   63,   63,   63,   63,    1,    2,    1,    1,
+	    0
 	};
 }
 
@@ -217,7 +219,7 @@ static final int puma_parser_en_main = 1;
 	cs = puma_parser_start;
 	}
 
-// line 90 "ext/puma_http11/http11_parser.java.rl"
+// line 88 "ext/puma_http11/http11_parser.java.rl"
 
           body_start = 0;
           content_len = 0;
@@ -420,7 +422,7 @@ case 5:
 	break; }
 	}
 
-// line 116 "ext/puma_http11/http11_parser.java.rl"
+// line 114 "ext/puma_http11/http11_parser.java.rl"
 
      parser.cs = cs;
      parser.nread += (p - off);

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.9".freeze
+    PUMA_VERSION = VERSION = "4.3.11".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 

data/lib/puma/server.rb

@@ -873,11 +873,14 @@ module Puma
         end
 
       ensure
-        uncork_socket client
+        begin
+          uncork_socket client
 
-        body.close
-        req.tempfile.unlink if req.tempfile
-        res_body.close if res_body.respond_to? :close
+          body.close
+          req.tempfile.unlink if req.tempfile
+        ensure
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 4.3.9
+  version: 4.3.11
 platform: ruby
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-10-12 00:00:00.000000000 Z
+date: 1980-01-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nio4r
@@ -136,7 +136,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.2.26
 signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for