puma 5.6.1-java → 5.6.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13ee538038db45a4708423f03dfd2d8ac9fdd8739ef69ea6f06dd627fbfd9430
-  data.tar.gz: cac82e9c940c2f2647cbc9f54c993f517540144676100f719f805f19923036c5
+  metadata.gz: d3f94c1f2a029d3e08b0a0659028977c9b1ed3925f6919b9979ed80af1bda9a4
+  data.tar.gz: c0967e20abd42d78b7b6d808cd5457eac582d7415d0bbd5cf6cdc59d3cdbb30e
 SHA512:
-  metadata.gz: a0b49f62e5e77305256fae6c69ca95d7c945c8622c2a66568e6a32cab6514d0b63a2526a567893a845cee0dabd3348805c5af183eca8b95c2f1a389f7438f05b
-  data.tar.gz: 9e816311e715873f136fa2095a65d0bfacd039af7200aef684c48c1ce78aedf1cf499ca3722a02866964acfc58a801845ff19326ad4ea53b91582fcbafac68a3
+  metadata.gz: 6ad3abb814699c0e22e169495761e6935c656bd01f5b90ad5acbe451c17748980aad2adf20bab0042a84bb217c0f16f2f670e9f32488a01d7ddb5069e5eda014
+  data.tar.gz: da91af701e49f770177af7daf9ce89c585e4bd0ffbc0725faecf9e1634c7b681ab84e68e72bae1eb9484b81a5fa4f3d47c3303093cfabdce66a3c526e6e957c2

data/History.md

@@ -1,3 +1,8 @@
+## 5.6.2 / 2022-02-11
+
+* Bugfix/Security
+  * Response body will always be `close`d. (GHSA-rmj8-8hhh-gv5h, related to [#2809])
+
 ## 5.6.1 / 2022-01-26
 
 * Bugfixes

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "5.6.1".freeze
+    PUMA_VERSION = VERSION = "5.6.2".freeze
     CODE_NAME = "Birdie's Version".freeze
 
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze

data/lib/puma/request.rb

@@ -167,11 +167,16 @@ module Puma
         end
 
       ensure
-        uncork_socket io
-
-        body.close
-        client.tempfile.unlink if client.tempfile
-        res_body.close if res_body.respond_to? :close
+        begin
+          uncork_socket io
+
+          body.close
+          client.tempfile.unlink if client.tempfile
+        ensure
+          # Whatever happens, we MUST call `close` on the response body.
+          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 5.6.1
+  version: 5.6.2
 platform: java
 authors:
 - Evan Phoenix