rack-graphql 2.5.0 → 2.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc3ae3d43695a7a533d43610adbc28395dcba6b2c53e7c1811402c98599c74bc
-  data.tar.gz: d0fa5477c6fc8006337dd5653f13fb9b486d79e019b24fd58956dc24867d4d71
+  metadata.gz: bd612f51ed5029ea31f162ccb63419bbda93203c1c4dc32fd8fe8dc8cb3df296
+  data.tar.gz: b58c4efcf02014ea60969fdd8d4375c19fa1f0bd143f7b6c1496b2e6f977ac05
 SHA512:
-  metadata.gz: cb4510a840bcc8450fb96ce824118fe9908bec545da22222484f32f1ca061b68a502c9fb30a5041f05e521c16dbd7c4f2241dec2ccb6e649c727b7c3ebf1ac36
-  data.tar.gz: f423c41a32de086c507006b5b2bea6c557931ce329505b25649dc09a93b6d2c1695c052f553f0fd699c53a2f9a16e6c863b2c5b0af62af6a304e114f0944d626
+  metadata.gz: f8e5816abcb0fc2b487331784dd29b23322a83c788a3f43ac11f02f435d67ed2bc61c9bedc544eb6dabc55376eeaba7d1a2a906f8e4077ad0d488fcce9e24adf
+  data.tar.gz: a7ab2a91badf6bdf080f023beb4e989a2883308896691fa52512fb2034c33ea93e5ed9deb6216cec43918a3e1d0af5e3d51917adbc0c429a924751271129826f

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 2.5.1 - 2020-11-18
+
+- respond with http status 400 when UTF null byte passed as part of input
+
 ## 2.5.0 - 2020-11-18
 
 - make `log_exception_backtrace` false by default and allow to be controlled by `RACK_GRAPHQL_LOG_EXCEPTION_BACKTRACE` env var

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rack-graphql (2.5.0)
+    rack-graphql (2.5.1)
       graphql (~> 1.11)
       oj
       rack (~> 2.2)

data/lib/rack_graphql/middleware.rb

@@ -74,7 +74,10 @@ module RackGraphql
     end
 
     def post_data(env)
-      ::Oj.load(env['rack.input'].gets.to_s)
+      payload = env['rack.input'].read.to_s
+      return nil if payload.index('\u0000')
+
+      ::Oj.load(payload)
     rescue Oj::ParseError
       nil
     end

data/lib/rack_graphql/version.rb

@@ -1,3 +1,3 @@
 module RackGraphql
-  VERSION = '2.5.0'.freeze
+  VERSION = '2.5.1'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-graphql
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.5.1
 platform: ruby
 authors:
 - Krzysztof Knapik
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-11-18 00:00:00.000000000 Z
+date: 2020-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: graphql