rack-proxy 1.0.1 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec993cb1f75831f1f7270d06634ba8c94b40246af6a622e239e29ddd2ff74e20
-  data.tar.gz: e5105cdc0ce7f69fb47b36e483dde1bad7799ff90f052566e526cc65d99fe7b5
+  metadata.gz: 3c875bfa1e0a111ffd460f491dd469b647b8eec3aeed9fe6fab60db8b7d40f27
+  data.tar.gz: cdecda577e3d8f9a5216822792f4e406b58168e82e151f9c876dbfeb1a84f66d
 SHA512:
-  metadata.gz: 701b98893deaf804c09f965a6ad12d3a7c219be357bfd1d3457beeab4598af699863b44df149a0d4c5c433dab75cdb3ee080a9503e9916142adb7a60ba3b8bf8
-  data.tar.gz: e75ba8fe0ed1beaa2aa480f3f19805e3a8be98c8ed05af84e9b00e6812b420a67d8d102031afcff78c23026193a43354b20126477e40d9f41ab50514ec0b8acc
+  metadata.gz: d5c20ab2119c472da460237bc3b731d09023e7805fe6a7f3a122209b3ce8a694ca1d1f5f6c328694b0b440628f08854507b2618e506ff35343fc6cc189cce52e
+  data.tar.gz: 745e5f847a9514d1524d11e272c4866576530c3734d106ef7818de84d9718d38ac5ffef664d86c8fe9e468dda19868ce2250bf847dc4e71e0124ea604e69cf08

data/CHANGELOG.md

@@ -8,6 +8,41 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 Nothing yet.
 
+## [1.0.3] - 2026-09-25
+
+### Security
+
+- Reject backend responses carrying both `Transfer-Encoding` and
+  `Content-Length` with `502` in streaming and non-streaming mode. This prevents
+  an attacker-controlled length from framing a dechunked downstream response
+  (GHSA-42qh-8mx8-7wqm). Rejected streaming responses close the backend connection.
+- Strip response headers named by all backend `Connection` fields, in addition
+  to the standard hop-by-hop headers.
+
+This is a targeted security backport for 1.x; successful response status types,
+header representations, request framing, and retry behavior remain unchanged.
+Versions 2.0.0 and later already reject the ambiguous response framing.
+
+## [1.0.2] - 2026-09-01
+
+Housekeeping — no library behavior changes. **No action is needed by users:**
+the shipped gem does not depend on `json` and was never affected by the
+advisory below.
+
+### Security
+
+- Development dependency `json` bumped 2.21.1 → 2.21.2 to clear
+  CVE-2026-71847 / GHSA-9hj4-r449-hfvc (`JSON::ResumableParser#partial_value`
+  dereferences a freed input buffer on truncated duplicate-key streams).
+  `json` reaches this repo only transitively (`standard` → `rubocop` → `json`)
+  and lives solely in the development `Gemfile.lock`; the bump keeps the CI
+  `bundler-audit` gate green.
+
+### Changed
+
+- Release workflow: the laggy rubygems full-index await was replaced with a
+  versions-API check, so a successful publish no longer fails the run. (#142)
+
 ## [1.0.1] - 2026-07-23
 
 Docs and housekeeping — no library behavior changes.
@@ -175,7 +210,9 @@ or a compatible fix. See the README's "Upgrading" section for migration steps.
 
 Older releases (≤ 0.7.8) predate this changelog; see the git history and tags.
 
-[Unreleased]: https://github.com/ncr/rack-proxy/compare/v1.0.1...HEAD
+[Unreleased]: https://github.com/ncr/rack-proxy/compare/v1.0.3...HEAD
+[1.0.3]: https://github.com/ncr/rack-proxy/compare/v1.0.2...v1.0.3
+[1.0.2]: https://github.com/ncr/rack-proxy/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/ncr/rack-proxy/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/ncr/rack-proxy/compare/v0.8.3...v1.0.0
 [0.8.3]: https://github.com/ncr/rack-proxy/compare/v0.8.2...v0.8.3

data/lib/rack/proxy/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class Proxy
-    VERSION = "1.0.1"
+    VERSION = "1.0.3"
   end
 end

data/lib/rack/proxy.rb

@@ -278,6 +278,13 @@ module Rack
 
         code = target_response.code
         headers = self.class.normalize_headers(target_response.respond_to?(:headers) ? target_response.headers : target_response.to_hash)
+        # Net::HTTP dechunks the body but retains the backend's Content-Length.
+        # Reject ambiguous framing before removing any hop-by-hop headers so
+        # that stale length can never frame the downstream response.
+        if headers.key?("Transfer-Encoding") && headers.key?("Content-Length")
+          target_response.close if target_response.respond_to?(:close)
+          return [502, {}, []]
+        end
         body = target_response.body || []
         body = [body] unless body.respond_to?(:each)
       rescue URI::InvalidURIError
@@ -293,7 +300,10 @@ module Rack
       # Remove hop-by-hop header fields from the response. Use #delete (not
       # #reject!) so the returned HeaderHash's case-insensitive index stays
       # consistent on Rack 2 for any downstream middleware.
-      headers.keys.each { |k| headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] }
+      connection_named = headers["Connection"].to_s.downcase.split(/[,\n]/).map(&:strip)
+      headers.keys.each do |k|
+        headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] || connection_named.include?(k.downcase)
+      end
 
       return [502, {}, []] if response_too_large?(target_response, headers, body)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-proxy
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.3
 platform: ruby
 authors:
 - Jacek Becela
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack