rack-proxy 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c85038309db55ace1d7ad2de733dc4a539859cf585c2ffb69b73c13a914f1d47
-  data.tar.gz: e0328851b0d2a9698b05f356bbb0322c6f3cf4c760b10d93a91194df0849ce44
+  metadata.gz: 3c875bfa1e0a111ffd460f491dd469b647b8eec3aeed9fe6fab60db8b7d40f27
+  data.tar.gz: cdecda577e3d8f9a5216822792f4e406b58168e82e151f9c876dbfeb1a84f66d
 SHA512:
-  metadata.gz: 7bba2a24c71a1521a3d9f9d42d7bffd56b8545f05a8f060fb7236c76d0d5dccba4099015eb25f69e5d98d79b937a4e6d8b26fac5e69345a814222bc65cf3f3d9
-  data.tar.gz: 34502c66d9801a04d95849773d3dc8c43aa24629db6cb780bb06834054ffc41588ddd1610ec39e33f6b7c64b163311633a47bc988b48eacd7d3e0578bda2568f
+  metadata.gz: d5c20ab2119c472da460237bc3b731d09023e7805fe6a7f3a122209b3ce8a694ca1d1f5f6c328694b0b440628f08854507b2618e506ff35343fc6cc189cce52e
+  data.tar.gz: 745e5f847a9514d1524d11e272c4866576530c3734d106ef7818de84d9718d38ac5ffef664d86c8fe9e468dda19868ce2250bf847dc4e71e0124ea604e69cf08

data/CHANGELOG.md

@@ -8,6 +8,21 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 Nothing yet.
 
+## [1.0.3] - 2026-09-25
+
+### Security
+
+- Reject backend responses carrying both `Transfer-Encoding` and
+  `Content-Length` with `502` in streaming and non-streaming mode. This prevents
+  an attacker-controlled length from framing a dechunked downstream response
+  (GHSA-42qh-8mx8-7wqm). Rejected streaming responses close the backend connection.
+- Strip response headers named by all backend `Connection` fields, in addition
+  to the standard hop-by-hop headers.
+
+This is a targeted security backport for 1.x; successful response status types,
+header representations, request framing, and retry behavior remain unchanged.
+Versions 2.0.0 and later already reject the ambiguous response framing.
+
 ## [1.0.2] - 2026-09-01
 
 Housekeeping — no library behavior changes. **No action is needed by users:**
@@ -195,7 +210,8 @@ or a compatible fix. See the README's "Upgrading" section for migration steps.
 
 Older releases (≤ 0.7.8) predate this changelog; see the git history and tags.
 
-[Unreleased]: https://github.com/ncr/rack-proxy/compare/v1.0.2...HEAD
+[Unreleased]: https://github.com/ncr/rack-proxy/compare/v1.0.3...HEAD
+[1.0.3]: https://github.com/ncr/rack-proxy/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/ncr/rack-proxy/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/ncr/rack-proxy/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/ncr/rack-proxy/compare/v0.8.3...v1.0.0

data/lib/rack/proxy/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class Proxy
-    VERSION = "1.0.2"
+    VERSION = "1.0.3"
   end
 end

data/lib/rack/proxy.rb

@@ -278,6 +278,13 @@ module Rack
 
         code = target_response.code
         headers = self.class.normalize_headers(target_response.respond_to?(:headers) ? target_response.headers : target_response.to_hash)
+        # Net::HTTP dechunks the body but retains the backend's Content-Length.
+        # Reject ambiguous framing before removing any hop-by-hop headers so
+        # that stale length can never frame the downstream response.
+        if headers.key?("Transfer-Encoding") && headers.key?("Content-Length")
+          target_response.close if target_response.respond_to?(:close)
+          return [502, {}, []]
+        end
         body = target_response.body || []
         body = [body] unless body.respond_to?(:each)
       rescue URI::InvalidURIError
@@ -293,7 +300,10 @@ module Rack
       # Remove hop-by-hop header fields from the response. Use #delete (not
       # #reject!) so the returned HeaderHash's case-insensitive index stays
       # consistent on Rack 2 for any downstream middleware.
-      headers.keys.each { |k| headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] }
+      connection_named = headers["Connection"].to_s.downcase.split(/[,\n]/).map(&:strip)
+      headers.keys.each do |k|
+        headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] || connection_named.include?(k.downcase)
+      end
 
       return [502, {}, []] if response_too_large?(target_response, headers, body)
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-proxy
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Jacek Becela
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack