puma 3.12.1 → 3.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d0e3b5d74ced5d332fa04832c60b4b8b9c16514f3441cefea046d6ca4948025
-  data.tar.gz: 9462d0f9e3357c2b245f194b43281e5f8e5ebf0ee981e7658a938d880e3e4404
+  metadata.gz: 8483f2a5087645c3b4a3f066a9ad804849c9c81d9df9c50ee17cc5a6594071bb
+  data.tar.gz: aee48433624d9efaeafe08c7747a38e8fd843645861ae82b3e2d8c59f1b7ecb5
 SHA512:
-  metadata.gz: 19ffe686429f3271d947e8fbc73c1e55113a0ad22eea2a194c80abac60cf675ea4162675f99d641e18e91d1d4270eae80644ccab5667ad263dfb32eb0b3075f2
-  data.tar.gz: 40876e43164a6103bcfc560a6034f4fb2215d0da39d84cb5d53f961da64a8d8e41e3f239f1a7886a0f13c6e6a1357608a54efc009517e1b3b2afc72c4a570b8d
+  metadata.gz: 95aa82dbc1af85a87975c27f5061ccd55349950e3d17336ad62271788601821f835dc53b9f8542d008de0d6f7f4fc8b128a89cf5300488016f573c34e319ee62
+  data.tar.gz: e4e97b12c6c3d285fb327201760f2ffcd80dd716f67b52aee02670940d141832ba28044ddfda969df173ebe9bbe1b58068714e6308897d62d308ee6daebe3f29

data/History.md

@@ -4,7 +4,12 @@
 
 * x bugfixes
 
-## 3.12.1 / 2019-01-08
+## 4.3.1 and 3.12.2 / 2019-12-05
+
+* Security
+  * Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770.
+
+## 3.12.1 / 2019-03-19
 
 * 1 features
   * Internal strings are frozen (#1649)

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "3.12.1".freeze
+    PUMA_VERSION = VERSION = "3.12.2".freeze
     CODE_NAME = "Llamas in Pajamas".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -118,6 +118,13 @@ module Puma
     # sending data back
     WRITE_TIMEOUT = 10
 
+    # How many requests to attempt inline before sending a client back to
+    # the reactor to be subject to normal ordering. The idea here is that
+    # we amortize the cost of going back to the reactor for a well behaved
+    # but very "greedy" client across 10 requests. This prevents a not
+    # well behaved client from monopolizing the thread forever.
+    MAX_FAST_INLINE = 10
+
     # The original URI requested by the client.
     REQUEST_URI= 'REQUEST_URI'.freeze
     REQUEST_PATH = 'REQUEST_PATH'.freeze

data/lib/puma/server.rb

@@ -470,6 +470,8 @@ module Puma
         clean_thread_locals = @options[:clean_thread_locals]
         close_socket = true
 
+        requests = 0
+
         while true
           case handle_request(client, buffer)
           when false
@@ -483,7 +485,19 @@ module Puma
 
             ThreadPool.clean_thread_locals if clean_thread_locals
 
-            unless client.reset(@status == :run)
+            requests += 1
+
+            check_for_more_data = @status == :run
+
+            if requests >= MAX_FAST_INLINE
+              # This will mean that reset will only try to use the data it already
+              # has buffered and won't try to read more data. What this means is that
+              # every client, independent of their request speed, gets treated like a slow
+              # one once every MAX_FAST_INLINE requests.
+              check_for_more_data = false
+            end
+
+            unless client.reset(check_for_more_data)
               close_socket = false
               client.set_timeout @persistent_timeout
               @reactor.add client

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 3.12.1
+  version: 3.12.2
 platform: ruby
 authors:
 - Evan Phoenix
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-19 00:00:00.000000000 Z
+date: 2019-12-05 00:00:00.000000000 Z
 dependencies: []
 description: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server
   for Ruby/Rack applications. Puma is intended for use in both development and production
@@ -108,7 +108,7 @@ licenses:
 - BSD-3-Clause
 metadata:
   msys2_mingw_dependencies: openssl
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -123,9 +123,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.7.6
-signing_key:
+rubygems_version: 3.0.3
+signing_key: 
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for
   Ruby/Rack applications