puma 5.6.1 → 5.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 469723b0faecde36baaac342696d0b59d73086f199a020e89d18ae33e2b181f0
-  data.tar.gz: cf2f9bb437d6bf29c6ad1fe5a166ed4db0c9c0c0d67a239d7f07e62b8d993a6b
+  metadata.gz: 9f2fbd628cb88e37c6df33dccf70b11f52b5e0ae56693e8ada921793cf607f0a
+  data.tar.gz: fd7fa2520c4ac378f616373655f9b72127cd50c1ba36db4d986857e736a526b1
 SHA512:
-  metadata.gz: b677ffb75bd299a97fc19eefa2caf8f3a80b8db0600d980ea4700fcb1fd12fd7c4079182e38bc4fc43879e668bffdc757247f4024dfd7e0d13ceb29181debbc4
-  data.tar.gz: cd06e3f7cbecffafb7aec87831a24055f45f5e6313d8808ab797116efa9e410e01539382499465f3c23bb957aace762ba24a9deb8ecfdc1c4bf1f0cff852688d
+  metadata.gz: 448267cd44a571941f8ab0133d9ab2a5bedd2c7fcd964fb3948a7a9a3190b8052a69e8b849e1bbb7622373a5ccf754cdd39d1e24b8fa839cf0af71015b608b30
+  data.tar.gz: b37d8563ce45b33bdd12ae8e4a913a8a702f36f7b4afaf16edf17611868da089d8b98ee130a565488f3007b0a28bce32202fe4f391a9ff81aa29e66a9372be36

data/History.md

@@ -1,3 +1,8 @@
+## 5.6.2 / 2022-02-11
+
+* Bugfix/Security
+  * Response body will always be `close`d. (GHSA-rmj8-8hhh-gv5h, related to [#2809])
+
 ## 5.6.1 / 2022-01-26
 
 * Bugfixes

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "5.6.1".freeze
+    PUMA_VERSION = VERSION = "5.6.2".freeze
     CODE_NAME = "Birdie's Version".freeze
 
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze

data/lib/puma/request.rb

@@ -167,11 +167,16 @@ module Puma
         end
 
       ensure
-        uncork_socket io
-
-        body.close
-        client.tempfile.unlink if client.tempfile
-        res_body.close if res_body.respond_to? :close
+        begin
+          uncork_socket io
+
+          body.close
+          client.tempfile.unlink if client.tempfile
+        ensure
+          # Whatever happens, we MUST call `close` on the response body.
+          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 5.6.1
+  version: 5.6.2
 platform: ruby
 authors:
 - Evan Phoenix