puma 6.3.0-java → 6.3.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ad102abd347c33f98c3a3a1000304ece5cbdbfe4bef67b4adbade6c91111cf0
-  data.tar.gz: 8f9d1ce702bcffeac26ee1882c94603c29130ec61a21e6158d0c0b4cf69cc228
+  metadata.gz: 6f5e262555fc1a48fc5b142830e71c44508163d7a411374379e3b95cb9543161
+  data.tar.gz: ca0ca73ded268f1d35b8e1dcd9f8b852a19dcc513bb2f103241f21a18bf5cb2a
 SHA512:
-  metadata.gz: f03c8f279ba9aa8139e056b1047a16c2e7f280cfbd9f3106c578d5782b8078dfd6d4c7ed3731066b20643f66bed6bcdf7b8a1e58fec429e0757940191e173dd0
-  data.tar.gz: 28e109af79749191f8ea47247f66dcdd55ed74a53fcd3443e3e918a173e880ba8938fdea59aaa6c5abbfe8626358a2e52da50cf4df67e9fafa546bc9b3dc5db9
+  metadata.gz: 97563d93043490539f1d265e209c2356bc5beb35f5e7da2f3a7bb5ebb5ae25b0e675cd374e267c9cb32be81d7fc8a132344968154e68b7d9b257e9c09498c129
+  data.tar.gz: 628fbc77c3b36f5324e3a4baf57a9d445b7168c6e8751f4d37e7b0a6b0d20c2cae4311228c72562f3a4ff0b2c7edfb776e8e5477405688176c4378df8fa9fde0

data/History.md

@@ -1,3 +1,8 @@
+## 6.3.1 / 2023-08-18
+
+* Security 
+  * Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields ([GHSA-68xg-gqqm-vgj8](https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8))
+
 ## 6.3.0 / 2023-05-31
 
 * Features

data/lib/puma/client.rb

@@ -49,7 +49,8 @@ module Puma
 
     # chunked body validation
     CHUNK_SIZE_INVALID = /[^\h]/.freeze
-    CHUNK_VALID_ENDING = "\r\n".freeze
+    CHUNK_VALID_ENDING = Const::LINE_END
+    CHUNK_VALID_ENDING_SIZE = CHUNK_VALID_ENDING.bytesize
 
     # Content-Length header value validation
     CONTENT_LENGTH_VALUE_INVALID = /[^\d]/.freeze
@@ -382,8 +383,8 @@ module Puma
       cl = @env[CONTENT_LENGTH]
 
       if cl
-        # cannot contain characters that are not \d
-        if CONTENT_LENGTH_VALUE_INVALID.match? cl
+        # cannot contain characters that are not \d, or be empty
+        if CONTENT_LENGTH_VALUE_INVALID.match?(cl) || cl.empty?
           raise HttpParserError, "Invalid Content-Length: #{cl.inspect}"
         end
       else
@@ -544,7 +545,7 @@ module Puma
 
       while !io.eof?
         line = io.gets
-        if line.end_with?("\r\n")
+        if line.end_with?(CHUNK_VALID_ENDING)
           # Puma doesn't process chunk extensions, but should parse if they're
           # present, which is the reason for the semicolon regex
           chunk_hex = line.strip[/\A[^;]+/]
@@ -556,13 +557,19 @@ module Puma
             @in_last_chunk = true
             @body.rewind
             rest = io.read
-            last_crlf_size = "\r\n".bytesize
-            if rest.bytesize < last_crlf_size
+            if rest.bytesize < CHUNK_VALID_ENDING_SIZE
               @buffer = nil
-              @partial_part_left = last_crlf_size - rest.bytesize
+              @partial_part_left = CHUNK_VALID_ENDING_SIZE - rest.bytesize
               return false
             else
-              @buffer = rest[last_crlf_size..-1]
+              # if the next character is a CRLF, set buffer to everything after that CRLF
+              start_of_rest = if rest.start_with?(CHUNK_VALID_ENDING)
+                CHUNK_VALID_ENDING_SIZE
+              else # we have started a trailer section, which we do not support. skip it!
+                rest.index(CHUNK_VALID_ENDING*2) + CHUNK_VALID_ENDING_SIZE*2
+              end
+
+              @buffer = rest[start_of_rest..-1]
               @buffer = nil if @buffer.empty?
               set_ready
               return true

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "6.3.0"
+    PUMA_VERSION = VERSION = "6.3.1"
     CODE_NAME = "Mugi No Toki Itaru"
 
     PUMA_SERVER_STRING = ["puma", PUMA_VERSION, CODE_NAME].join(" ").freeze

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 6.3.0
+  version: 6.3.1
 platform: java
 authors:
 - Evan Phoenix
@@ -17,8 +17,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
   name: nio4r
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -145,7 +145,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for