puma 5.6.5-java → 5.6.7-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dbcda6d79adb4aa746e6aae4e5c451228c253fb0c27f5ed1c48f390986180b2b
-  data.tar.gz: 1f22364a0d67c98fd540db2fcc78c7dcc95626f72f37e4375fa7630f5cc81078
+  metadata.gz: c7739d532cbd298f6d3fe97c1c5e99af45d29b792649705851542ac54aafbd2c
+  data.tar.gz: a066b4636189819ea7109124c470eb2cba5f35083ab7c01b4389552a4acb9220
 SHA512:
-  metadata.gz: c4eef14fa604a728d27754505bb2e22c29079637d5a3ad80b95a26c9b8d1ca4f9921f1710ce706ce407bffb778d7e7544e2d9b616ee42bac2d4285719f704ebb
-  data.tar.gz: '095ae93926d73d2d5ae5c6a46e747c96e298279db8b0f997b60012f6f750d59c9e69a6efbae4a75d5f74ff84fa1ed1183931f05894b631a05082871b536141a2'
+  metadata.gz: 010d1a62e046ccaef614623e59511b235f77eb4d292ef00b415d25335ced57344c758409dff13a88e730df8d644507421567102a9b1fbd7856dc96ed6546ba4e
+  data.tar.gz: 304182f6bf28e4262e622bd9d00e504db9c2682e484c525a36efea6e141891adabdec427c6a8cf619fae6860266865b01fa39056b52a838bb19b285f9320361b

data/History.md

@@ -1,8 +1,20 @@
+## 5.6.7 / 2023-08-18
+
+* Security 
+  * Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields ([GHSA-68xg-gqqm-vgj8](https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8))
+
+## 5.6.6 / 2023-06-21
+
+* Bugfix
+  * Allow Puma to be loaded with Rack 3 ([#3166])
+
 ## 5.6.5 / 2022-08-23
 
+* Feature
+  * Puma::ControlCLI - allow refork command to be sent as a request ([#2868], [#2866])
+
 * Bugfixes
   * NullIO#closed should return false ([#2883])
-  * Puma::ControlCLI - allow refork command to be sent as a request ([#2868], [#2866])
   * [jruby] Fix TLS verification hang ([#2890], [#2729])
   * extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used ([#2885], [#2839])
   * MiniSSL - detect SSL_CTX_set_dh_auto ([#2864], [#2863])
@@ -1861,6 +1873,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#3166]:https://github.com/puma/puma/issues/3166   "Issue by @JoeDupuis, merged 2023-06-08"
 [#2883]:https://github.com/puma/puma/pull/2883     "PR by @MSP-Greg, merged 2022-06-02"
 [#2868]:https://github.com/puma/puma/pull/2868     "PR by @MSP-Greg, merged 2022-06-02"
 [#2866]:https://github.com/puma/puma/issues/2866   "Issue by @slondr, closed 2022-06-02"

data/lib/puma/client.rb

@@ -45,7 +45,8 @@ module Puma
 
     # chunked body validation
     CHUNK_SIZE_INVALID = /[^\h]/.freeze
-    CHUNK_VALID_ENDING = "\r\n".freeze
+    CHUNK_VALID_ENDING = Const::LINE_END
+    CHUNK_VALID_ENDING_SIZE = CHUNK_VALID_ENDING.bytesize
 
     # Content-Length header value validation
     CONTENT_LENGTH_VALUE_INVALID = /[^\d]/.freeze
@@ -347,8 +348,8 @@ module Puma
       cl = @env[CONTENT_LENGTH]
 
       if cl
-        # cannot contain characters that are not \d
-        if cl =~ CONTENT_LENGTH_VALUE_INVALID
+        # cannot contain characters that are not \d, or be empty
+        if cl =~ CONTENT_LENGTH_VALUE_INVALID || cl.empty?
           raise HttpParserError, "Invalid Content-Length: #{cl.inspect}"
         end
       else
@@ -509,7 +510,7 @@ module Puma
 
       while !io.eof?
         line = io.gets
-        if line.end_with?("\r\n")
+        if line.end_with?(CHUNK_VALID_ENDING)
           # Puma doesn't process chunk extensions, but should parse if they're
           # present, which is the reason for the semicolon regex
           chunk_hex = line.strip[/\A[^;]+/]
@@ -521,13 +522,19 @@ module Puma
             @in_last_chunk = true
             @body.rewind
             rest = io.read
-            last_crlf_size = "\r\n".bytesize
-            if rest.bytesize < last_crlf_size
+            if rest.bytesize < CHUNK_VALID_ENDING_SIZE
               @buffer = nil
-              @partial_part_left = last_crlf_size - rest.bytesize
+              @partial_part_left = CHUNK_VALID_ENDING_SIZE - rest.bytesize
               return false
             else
-              @buffer = rest[last_crlf_size..-1]
+              # if the next character is a CRLF, set buffer to everything after that CRLF
+              start_of_rest = if rest.start_with?(CHUNK_VALID_ENDING)
+                CHUNK_VALID_ENDING_SIZE
+              else # we have started a trailer section, which we do not support. skip it!
+                rest.index(CHUNK_VALID_ENDING*2) + CHUNK_VALID_ENDING_SIZE*2
+              end
+
+              @buffer = rest[start_of_rest..-1]
               @buffer = nil if @buffer.empty?
               set_ready
               return true

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "5.6.5".freeze
+    PUMA_VERSION = VERSION = "5.6.7".freeze
     CODE_NAME = "Birdie's Version".freeze
 
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze

data/lib/puma.rb

@@ -10,9 +10,11 @@ require 'stringio'
 
 require 'thread'
 
+# extension files should not be loaded with `require_relative`
 require 'puma/puma_http11'
-require 'puma/detect'
-require 'puma/json_serialization'
+require_relative 'puma/detect'
+require_relative 'puma/json_serialization'
+require_relative 'rack/version_restriction'
 
 module Puma
   autoload :Const, 'puma/const'
@@ -23,7 +25,7 @@ module Puma
   # not in minissl.rb
   HAS_SSL = const_defined?(:MiniSSL, false) && MiniSSL.const_defined?(:Engine, false)
 
-  HAS_UNIX_SOCKET = Object.const_defined? :UNIXSocket
+  HAS_UNIX_SOCKET = Object.const_defined?(:UNIXSocket) && !IS_WINDOWS
 
   if HAS_SSL
     require 'puma/minissl'

data/lib/rack/version_restriction.rb

@@ -0,0 +1,15 @@
+begin
+  begin
+    # rack/version exists in Rack 2.2.0 and later, compatible with Ruby 2.3 and later
+    # we prefer to not load Rack
+    require 'rack/version'
+  rescue LoadError
+    require 'rack'
+  end
+
+  # Rack.release is needed for Rack v1, Rack::RELEASE was added in v2
+  if Gem::Version.new(Rack.release) >= Gem::Version.new("3.0.0")
+    raise StandardError.new "Puma 5 is not compatible with Rack 3, please upgrade to Puma 6 or higher."
+  end
+rescue LoadError
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 5.6.5
+  version: 5.6.7
 platform: java
 authors:
 - Evan Phoenix
@@ -17,8 +17,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
   name: nio4r
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -115,6 +115,7 @@ files:
 - lib/puma/thread_pool.rb
 - lib/puma/util.rb
 - lib/rack/handler/puma.rb
+- lib/rack/version_restriction.rb
 - tools/Dockerfile
 - tools/trickletest.rb
 homepage: https://puma.io
@@ -140,7 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.29
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for