rack-protection 2.0.3 → 2.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1aa329182b5c0232c8aee21af5e4a32d3524ce29d7bf5db86fd60b11ac4edae3
-  data.tar.gz: d8cc565e127f5f68892d67d5e8451b9edd52e51044cb4ac09c9138143cf80dbb
+  metadata.gz: 8409e3948b276eede337038b10bb8dc59add80afbfa28fbcd2160f9f52670b82
+  data.tar.gz: 1d5485791b331fad229c63535c5c94761dc839194a90ee22811a9eb6a5e6be40
 SHA512:
-  metadata.gz: af777eb2ffe6bda436fba4705298958a076d29c7651b6bd69c8196f517c27733e39f5c38a54bd449a9f484af9ed7d0abcd68f5bf599f16549f4aa56cad2cb332
-  data.tar.gz: 245a1a904495cf289455a1b11d139cb80083dd0aa8da9040c09692fb307bf4cdd85944182bda81f5e096d68c8962035151a5e443f0b5bed5b82dbb94d9d80cd0
+  metadata.gz: 1bb5f7e556b1fdf46dd029c4f620e7062527d4b3280d0ce80e43552d5fd260f3445a4411f0f680689d215cc4532cb1e3f5b5cf64eae91a8411daccabeedcf557
+  data.tar.gz: 3108b981b3ada3ea6959f494f08fc6ea1c15e0bf9f269cf5d8a4c82103f9cdcf7d858fbf864eb95ab98fa9eaf041aef4d8f352d05e55167879563e7500896967

data/lib/rack/protection/path_traversal.rb

@@ -19,18 +19,10 @@ module Rack
       end
 
       def cleanup(path)
-        if path.respond_to?(:encoding)
-          # Ruby 1.9+ M17N
-          encoding = path.encoding
-          dot   = '.'.encode(encoding)
-          slash = '/'.encode(encoding)
-          backslash = '\\'.encode(encoding)
-        else
-          # Ruby 1.8
-          dot   = '.'
-          slash = '/'
-          backslash = '\\'
-        end
+        encoding = path.encoding
+        dot   = '.'.encode(encoding)
+        slash = '/'.encode(encoding)
+        backslash = '\\'.encode(encoding)
 
         parts     = []
         unescaped = path.gsub(/%2e/i, dot).gsub(/%2f/i, slash).gsub(/%5c/i, backslash)

data/lib/rack/protection/session_hijacking.rb

@@ -14,7 +14,7 @@ module Rack
     class SessionHijacking < Base
       default_reaction :drop_session
       default_options :tracking_key => :tracking, :encrypt_tracking => true,
-        :track => %w[HTTP_USER_AGENT HTTP_ACCEPT_LANGUAGE]
+        :track => %w[HTTP_USER_AGENT]
 
       def accepts?(env)
         session = session env

data/lib/rack/protection/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Protection
-    VERSION = '2.0.3'
+    VERSION = '2.0.7'
   end
 end

data/rack-protection.gemspec

@@ -5,7 +5,7 @@ Gem::Specification.new do |s|
   s.name        = "rack-protection"
   s.version     = version
   s.description = "Protect against typical web attacks, works with all Rack apps, including Rails."
-  s.homepage    = "http://www.sinatrarb.com/protection/"
+  s.homepage    = "http://sinatrarb.com/protection/"
   s.summary     = s.description
   s.license     = 'MIT'
   s.authors     = ["https://github.com/sinatra/sinatra/graphs/contributors"]
@@ -18,6 +18,21 @@ Gem::Specification.new do |s|
     "rack-protection.gemspec"
   ]
 
+  if s.respond_to?(:metadata)
+    s.metadata = {
+      'source_code_uri'   => 'https://github.com/sinatra/sinatra/tree/master/rack-protection',
+      'homepage_uri'      => 'http://sinatrarb.com/protection/',
+      'documentation_uri' => 'https://www.rubydoc.info/gems/rack-protection'
+    }
+  else
+    raise <<-EOF
+RubyGems 2.0 or newer is required to protect against public gem pushes. You can update your rubygems version by running:
+  gem install rubygems-update
+  update_rubygems:
+  gem update --system
+EOF
+  end
+
   # dependencies
   s.add_dependency "rack"
   s.add_development_dependency "rack-test"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-protection
 version: !ruby/object:Gem::Version
-  version: 2.0.3
+  version: 2.0.7
 platform: ruby
 authors:
 - https://github.com/sinatra/sinatra/graphs/contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-08 00:00:00.000000000 Z
+date: 2019-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -83,10 +83,13 @@ files:
 - lib/rack/protection/version.rb
 - lib/rack/protection/xss_header.rb
 - rack-protection.gemspec
-homepage: http://www.sinatrarb.com/protection/
+homepage: http://sinatrarb.com/protection/
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/sinatra/sinatra/tree/master/rack-protection
+  homepage_uri: http://sinatrarb.com/protection/
+  documentation_uri: https://www.rubydoc.info/gems/rack-protection
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -103,7 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: Protect against typical web attacks, works with all Rack apps, including