puma 5.6.1-java → 5.6.2-java

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of puma might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 13ee538038db45a4708423f03dfd2d8ac9fdd8739ef69ea6f06dd627fbfd9430
4
- data.tar.gz: cac82e9c940c2f2647cbc9f54c993f517540144676100f719f805f19923036c5
3
+ metadata.gz: d3f94c1f2a029d3e08b0a0659028977c9b1ed3925f6919b9979ed80af1bda9a4
4
+ data.tar.gz: c0967e20abd42d78b7b6d808cd5457eac582d7415d0bbd5cf6cdc59d3cdbb30e
5
5
  SHA512:
6
- metadata.gz: a0b49f62e5e77305256fae6c69ca95d7c945c8622c2a66568e6a32cab6514d0b63a2526a567893a845cee0dabd3348805c5af183eca8b95c2f1a389f7438f05b
7
- data.tar.gz: 9e816311e715873f136fa2095a65d0bfacd039af7200aef684c48c1ce78aedf1cf499ca3722a02866964acfc58a801845ff19326ad4ea53b91582fcbafac68a3
6
+ metadata.gz: 6ad3abb814699c0e22e169495761e6935c656bd01f5b90ad5acbe451c17748980aad2adf20bab0042a84bb217c0f16f2f670e9f32488a01d7ddb5069e5eda014
7
+ data.tar.gz: da91af701e49f770177af7daf9ce89c585e4bd0ffbc0725faecf9e1634c7b681ab84e68e72bae1eb9484b81a5fa4f3d47c3303093cfabdce66a3c526e6e957c2
data/History.md CHANGED
@@ -1,3 +1,8 @@
1
+ ## 5.6.2 / 2022-02-11
2
+
3
+ * Bugfix/Security
4
+ * Response body will always be `close`d. (GHSA-rmj8-8hhh-gv5h, related to [#2809])
5
+
1
6
  ## 5.6.1 / 2022-01-26
2
7
 
3
8
  * Bugfixes
data/lib/puma/const.rb CHANGED
@@ -100,7 +100,7 @@ module Puma
100
100
  # too taxing on performance.
101
101
  module Const
102
102
 
103
- PUMA_VERSION = VERSION = "5.6.1".freeze
103
+ PUMA_VERSION = VERSION = "5.6.2".freeze
104
104
  CODE_NAME = "Birdie's Version".freeze
105
105
 
106
106
  PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
Binary file
data/lib/puma/request.rb CHANGED
@@ -167,11 +167,16 @@ module Puma
167
167
  end
168
168
 
169
169
  ensure
170
- uncork_socket io
171
-
172
- body.close
173
- client.tempfile.unlink if client.tempfile
174
- res_body.close if res_body.respond_to? :close
170
+ begin
171
+ uncork_socket io
172
+
173
+ body.close
174
+ client.tempfile.unlink if client.tempfile
175
+ ensure
176
+ # Whatever happens, we MUST call `close` on the response body.
177
+ # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
178
+ res_body.close if res_body.respond_to? :close
179
+ end
175
180
 
176
181
  after_reply.each { |o| o.call }
177
182
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: puma
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.6.1
4
+ version: 5.6.2
5
5
  platform: java
6
6
  authors:
7
7
  - Evan Phoenix