puma 6.4.1-java → 6.4.3-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/History.md +20 -0
- data/ext/puma_http11/org/jruby/puma/Http11.java +2 -0
- data/lib/puma/client.rb +27 -0
- data/lib/puma/const.rb +9 -1
- data/lib/puma/puma_http11.jar +0 -0
- data/lib/puma/request.rb +16 -3
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 2c64abd1fab8a1c0fba14f0294713f8e903c8fecd721c7f057dfdbe0805747fc
|
4
|
+
data.tar.gz: a402d2a1cae3e79f46cfb6d896962edbf267afedc0d3875a1da461a6512d8d57
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: bbf05e7a426685b8122a443bf2c658f1c9f98ff66125953a34174ccfff3a3340f63eeac5adb93c25c563e67d830741fe35c8a9555acdda4d51e59159a1954cc5
|
7
|
+
data.tar.gz: 668bd2b0817bd8da6a2bfcf9ad8eb5c7383b3911a112e75c6547d4e7daa21e5d0c8bbf44a010dae88a939d492e109a5197746380e4c21805bcb50228b790af80
|
data/History.md
CHANGED
@@ -1,3 +1,13 @@
|
|
1
|
+
## 6.4.3 / 2024-09-19
|
2
|
+
|
3
|
+
* Security
|
4
|
+
* Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). ([CVE-2024-45614](https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4)/GHSA-9hf4-67fc-4vf4)
|
5
|
+
|
6
|
+
## 6.4.2 / 2024-01-08
|
7
|
+
|
8
|
+
* Security
|
9
|
+
* Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ([GHSA-c2f4-cvqm-65w2](https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2))
|
10
|
+
|
1
11
|
## 6.4.1 / 2024-01-03
|
2
12
|
|
3
13
|
* Bugfixes
|
@@ -168,6 +178,16 @@
|
|
168
178
|
* Ruby 3.2 will have native IO#wait_* methods, don't require io/wait ([#2903])
|
169
179
|
* Various internal API refactorings ([#2942], [#2921], [#2922], [#2955])
|
170
180
|
|
181
|
+
## 5.6.9 / 2024-09-19
|
182
|
+
|
183
|
+
* Security
|
184
|
+
* Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). ([CVE-2024-45614](https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4)/GHSA-9hf4-67fc-4vf4)
|
185
|
+
|
186
|
+
## 5.6.8 / 2024-01-08
|
187
|
+
|
188
|
+
* Security
|
189
|
+
* Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ([GHSA-c2f4-cvqm-65w2](https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2))
|
190
|
+
|
171
191
|
## 5.6.7 / 2023-08-18
|
172
192
|
|
173
193
|
* Security
|
data/lib/puma/client.rb
CHANGED
@@ -51,6 +51,14 @@ module Puma
|
|
51
51
|
CHUNK_VALID_ENDING = Const::LINE_END
|
52
52
|
CHUNK_VALID_ENDING_SIZE = CHUNK_VALID_ENDING.bytesize
|
53
53
|
|
54
|
+
# The maximum number of bytes we'll buffer looking for a valid
|
55
|
+
# chunk header.
|
56
|
+
MAX_CHUNK_HEADER_SIZE = 4096
|
57
|
+
|
58
|
+
# The maximum amount of excess data the client sends
|
59
|
+
# using chunk size extensions before we abort the connection.
|
60
|
+
MAX_CHUNK_EXCESS = 16 * 1024
|
61
|
+
|
54
62
|
# Content-Length header value validation
|
55
63
|
CONTENT_LENGTH_VALUE_INVALID = /[^\d]/.freeze
|
56
64
|
|
@@ -496,6 +504,7 @@ module Puma
|
|
496
504
|
@chunked_body = true
|
497
505
|
@partial_part_left = 0
|
498
506
|
@prev_chunk = ""
|
507
|
+
@excess_cr = 0
|
499
508
|
|
500
509
|
@body = Tempfile.new(Const::PUMA_TMP_BASE)
|
501
510
|
@body.unlink
|
@@ -577,6 +586,20 @@ module Puma
|
|
577
586
|
end
|
578
587
|
end
|
579
588
|
|
589
|
+
# Track the excess as a function of the size of the
|
590
|
+
# header vs the size of the actual data. Excess can
|
591
|
+
# go negative (and is expected to) when the body is
|
592
|
+
# significant.
|
593
|
+
# The additional of chunk_hex.size and 2 compensates
|
594
|
+
# for a client sending 1 byte in a chunked body over
|
595
|
+
# a long period of time, making sure that that client
|
596
|
+
# isn't accidentally eventually punished.
|
597
|
+
@excess_cr += (line.size - len - chunk_hex.size - 2)
|
598
|
+
|
599
|
+
if @excess_cr >= MAX_CHUNK_EXCESS
|
600
|
+
raise HttpParserError, "Maximum chunk excess detected"
|
601
|
+
end
|
602
|
+
|
580
603
|
len += 2
|
581
604
|
|
582
605
|
part = io.read(len)
|
@@ -604,6 +627,10 @@ module Puma
|
|
604
627
|
@partial_part_left = len - part.size
|
605
628
|
end
|
606
629
|
else
|
630
|
+
if @prev_chunk.size + chunk.size >= MAX_CHUNK_HEADER_SIZE
|
631
|
+
raise HttpParserError, "maximum size of chunk header exceeded"
|
632
|
+
end
|
633
|
+
|
607
634
|
@prev_chunk = line
|
608
635
|
return false
|
609
636
|
end
|
data/lib/puma/const.rb
CHANGED
@@ -100,7 +100,7 @@ module Puma
|
|
100
100
|
# too taxing on performance.
|
101
101
|
module Const
|
102
102
|
|
103
|
-
PUMA_VERSION = VERSION = "6.4.
|
103
|
+
PUMA_VERSION = VERSION = "6.4.3"
|
104
104
|
CODE_NAME = "The Eagle of Durango"
|
105
105
|
|
106
106
|
PUMA_SERVER_STRING = ["puma", PUMA_VERSION, CODE_NAME].join(" ").freeze
|
@@ -281,6 +281,14 @@ module Puma
|
|
281
281
|
# header values can contain HTAB?
|
282
282
|
ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/.freeze
|
283
283
|
|
284
|
+
# The keys of headers that should not be convert to underscore
|
285
|
+
# normalized versions. These headers are ignored at the request reading layer,
|
286
|
+
# but if we normalize them after reading, it's just confusing for the application.
|
287
|
+
UNMASKABLE_HEADERS = {
|
288
|
+
"HTTP_TRANSFER,ENCODING" => true,
|
289
|
+
"HTTP_CONTENT,LENGTH" => true,
|
290
|
+
}
|
291
|
+
|
284
292
|
# Banned keys of response header
|
285
293
|
BANNED_HEADER_KEY = /\A(rack\.|status\z)/.freeze
|
286
294
|
|
data/lib/puma/puma_http11.jar
CHANGED
Binary file
|
data/lib/puma/request.rb
CHANGED
@@ -495,6 +495,11 @@ module Puma
|
|
495
495
|
# compatibility, we'll convert them back. This code is written to
|
496
496
|
# avoid allocation in the common case (ie there are no headers
|
497
497
|
# with `,` in their names), that's why it has the extra conditionals.
|
498
|
+
#
|
499
|
+
# @note If a normalized version of a `,` header already exists, we ignore
|
500
|
+
# the `,` version. This prevents clobbering headers managed by proxies
|
501
|
+
# but not by clients (Like X-Forwarded-For).
|
502
|
+
#
|
498
503
|
# @param env [Hash] see Puma::Client#env, from request, modifies in place
|
499
504
|
# @version 5.0.3
|
500
505
|
#
|
@@ -503,23 +508,31 @@ module Puma
|
|
503
508
|
to_add = nil
|
504
509
|
|
505
510
|
env.each do |k,v|
|
506
|
-
if k.start_with?("HTTP_") && k.include?(",") && k
|
511
|
+
if k.start_with?("HTTP_") && k.include?(",") && !UNMASKABLE_HEADERS.key?(k)
|
507
512
|
if to_delete
|
508
513
|
to_delete << k
|
509
514
|
else
|
510
515
|
to_delete = [k]
|
511
516
|
end
|
512
517
|
|
518
|
+
new_k = k.tr(",", "_")
|
519
|
+
if env.key?(new_k)
|
520
|
+
next
|
521
|
+
end
|
522
|
+
|
513
523
|
unless to_add
|
514
524
|
to_add = {}
|
515
525
|
end
|
516
526
|
|
517
|
-
to_add[
|
527
|
+
to_add[new_k] = v
|
518
528
|
end
|
519
529
|
end
|
520
530
|
|
521
|
-
if to_delete
|
531
|
+
if to_delete # rubocop:disable Style/SafeNavigation
|
522
532
|
to_delete.each { |k| env.delete(k) }
|
533
|
+
end
|
534
|
+
|
535
|
+
if to_add
|
523
536
|
env.merge! to_add
|
524
537
|
end
|
525
538
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: puma
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 6.4.
|
4
|
+
version: 6.4.3
|
5
5
|
platform: java
|
6
6
|
authors:
|
7
7
|
- Evan Phoenix
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-09-19 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|