rack-protection 2.2.1 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e901f1cfa34ea0aa6b13be17c71316ae7dbbea93a778f0987e3bac6d795d502
-  data.tar.gz: 701fb3d7ae00c8c15326c179905d46a4a1ce43c038158247c11969eb80358dee
+  metadata.gz: 41643b8e96c39cab78011412440435328537bdccf21141fd3a448b3b3fd905ba
+  data.tar.gz: 94385c3ad84be0e4a7472efb54f1eb7c4b373c7b6c845bdf1b66b03bef9ad63d
 SHA512:
-  metadata.gz: 32a5cfa10061ee479768089916d00b0c39c68f7e0a851221307d88a63bc31f53f3034e87e192061ec6cae5f15cccaff07c0609986d21d2e09f9bf9845255a3b0
-  data.tar.gz: 913396747a895659eb7609e278242939895816a9dab7f1e9ad99c0dd17c05e44edf406c8a53347c47d7a6eb2a04feae0e19af99099fc623a16d434ec87abaa78
+  metadata.gz: fe3546ac3539741b388c9468bd79b9773b2fbb4a0ed02b71e43b1940008c631232f832e0ec4d93408a3d2a73e7e2ae676b541241798fd2219099c85ebab9267d
+  data.tar.gz: 00dbd06226c8481fbd292171b797407a79dee5fa76a20ec90c3f9d4dec3e24d15ad383c4824589084b7f5639644a19c3cfdf8be3ecdbe03ae4162ef3a576fc2c

data/lib/rack/protection/ip_spoofing.rb

@@ -13,9 +13,11 @@ module Rack
 
       def accepts?(env)
         return true unless env.include? 'HTTP_X_FORWARDED_FOR'
-        ips = env['HTTP_X_FORWARDED_FOR'].split(/\s*,\s*/)
-        return false if env.include? 'HTTP_CLIENT_IP' and not ips.include? env['HTTP_CLIENT_IP']
-        return false if env.include? 'HTTP_X_REAL_IP' and not ips.include? env['HTTP_X_REAL_IP']
+
+        ips = env['HTTP_X_FORWARDED_FOR'].split(',').map(&:strip)
+        return false if env.include?('HTTP_CLIENT_IP') && (!ips.include? env['HTTP_CLIENT_IP'])
+        return false if env.include?('HTTP_X_REAL_IP') && (!ips.include? env['HTTP_X_REAL_IP'])
+
         true
       end
     end

data/lib/rack/protection/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Protection
-    VERSION = '2.2.1'
+    VERSION = '2.2.2'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-protection
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.2.3
 platform: ruby
 authors:
 - https://github.com/sinatra/sinatra/graphs/contributors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-07-15 00:00:00.000000000 Z
+date: 2022-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -106,7 +106,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
+rubyforge_project:
+rubygems_version: 2.7.6.3
 signing_key:
 specification_version: 4
 summary: Protect against typical web attacks, works with all Rack apps, including