rack 2.0.9.3 → 2.2.6.4

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rack might be problematic. Click here for more details.

Files changed (191) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +735 -0
  3. data/CONTRIBUTING.md +136 -0
  4. data/{COPYING → MIT-LICENSE} +4 -2
  5. data/README.rdoc +151 -147
  6. data/Rakefile +37 -23
  7. data/{SPEC → SPEC.rdoc} +35 -10
  8. data/bin/rackup +1 -0
  9. data/example/lobster.ru +2 -0
  10. data/example/protectedlobster.rb +3 -1
  11. data/example/protectedlobster.ru +2 -0
  12. data/lib/rack/auth/abstract/handler.rb +3 -1
  13. data/lib/rack/auth/abstract/request.rb +1 -1
  14. data/lib/rack/auth/basic.rb +7 -4
  15. data/lib/rack/auth/digest/md5.rb +13 -11
  16. data/lib/rack/auth/digest/nonce.rb +6 -3
  17. data/lib/rack/auth/digest/params.rb +4 -2
  18. data/lib/rack/auth/digest/request.rb +5 -3
  19. data/lib/rack/body_proxy.rb +15 -14
  20. data/lib/rack/builder.rb +116 -23
  21. data/lib/rack/cascade.rb +28 -12
  22. data/lib/rack/chunked.rb +68 -20
  23. data/lib/rack/common_logger.rb +33 -25
  24. data/lib/rack/conditional_get.rb +20 -16
  25. data/lib/rack/config.rb +2 -0
  26. data/lib/rack/content_length.rb +8 -7
  27. data/lib/rack/content_type.rb +5 -4
  28. data/lib/rack/core_ext/regexp.rb +14 -0
  29. data/lib/rack/deflater.rb +59 -34
  30. data/lib/rack/directory.rb +84 -64
  31. data/lib/rack/etag.rb +7 -4
  32. data/lib/rack/events.rb +19 -20
  33. data/lib/rack/file.rb +4 -173
  34. data/lib/rack/files.rb +218 -0
  35. data/lib/rack/handler/cgi.rb +2 -3
  36. data/lib/rack/handler/fastcgi.rb +4 -4
  37. data/lib/rack/handler/lsws.rb +3 -3
  38. data/lib/rack/handler/scgi.rb +9 -8
  39. data/lib/rack/handler/thin.rb +3 -3
  40. data/lib/rack/handler/webrick.rb +15 -6
  41. data/lib/rack/handler.rb +7 -2
  42. data/lib/rack/head.rb +1 -1
  43. data/lib/rack/lint.rb +71 -25
  44. data/lib/rack/lobster.rb +10 -10
  45. data/lib/rack/lock.rb +2 -1
  46. data/lib/rack/logger.rb +2 -0
  47. data/lib/rack/media_type.rb +10 -5
  48. data/lib/rack/method_override.rb +5 -3
  49. data/lib/rack/mime.rb +9 -1
  50. data/lib/rack/mock.rb +97 -20
  51. data/lib/rack/multipart/generator.rb +17 -13
  52. data/lib/rack/multipart/parser.rb +53 -56
  53. data/lib/rack/multipart/uploaded_file.rb +15 -7
  54. data/lib/rack/multipart.rb +4 -2
  55. data/lib/rack/null_logger.rb +2 -0
  56. data/lib/rack/query_parser.rb +59 -30
  57. data/lib/rack/recursive.rb +7 -5
  58. data/lib/rack/reloader.rb +8 -4
  59. data/lib/rack/request.rb +222 -63
  60. data/lib/rack/response.rb +127 -44
  61. data/lib/rack/rewindable_input.rb +4 -3
  62. data/lib/rack/runtime.rb +6 -4
  63. data/lib/rack/sendfile.rb +13 -9
  64. data/lib/rack/server.rb +95 -24
  65. data/lib/rack/session/abstract/id.rb +34 -21
  66. data/lib/rack/session/cookie.rb +11 -12
  67. data/lib/rack/session/memcache.rb +4 -93
  68. data/lib/rack/session/pool.rb +5 -3
  69. data/lib/rack/show_exceptions.rb +21 -17
  70. data/lib/rack/show_status.rb +9 -9
  71. data/lib/rack/static.rb +23 -11
  72. data/lib/rack/tempfile_reaper.rb +1 -1
  73. data/lib/rack/urlmap.rb +13 -7
  74. data/lib/rack/utils.rb +105 -111
  75. data/lib/rack/version.rb +29 -0
  76. data/lib/rack.rb +67 -73
  77. data/rack.gemspec +40 -28
  78. metadata +39 -182
  79. data/HISTORY.md +0 -520
  80. data/test/builder/an_underscore_app.rb +0 -5
  81. data/test/builder/anything.rb +0 -5
  82. data/test/builder/comment.ru +0 -4
  83. data/test/builder/end.ru +0 -5
  84. data/test/builder/line.ru +0 -1
  85. data/test/builder/options.ru +0 -2
  86. data/test/cgi/assets/folder/test.js +0 -1
  87. data/test/cgi/assets/fonts/font.eot +0 -1
  88. data/test/cgi/assets/images/image.png +0 -1
  89. data/test/cgi/assets/index.html +0 -1
  90. data/test/cgi/assets/javascripts/app.js +0 -1
  91. data/test/cgi/assets/stylesheets/app.css +0 -1
  92. data/test/cgi/lighttpd.conf +0 -26
  93. data/test/cgi/rackup_stub.rb +0 -6
  94. data/test/cgi/sample_rackup.ru +0 -5
  95. data/test/cgi/test +0 -9
  96. data/test/cgi/test+directory/test+file +0 -1
  97. data/test/cgi/test.fcgi +0 -9
  98. data/test/cgi/test.gz +0 -0
  99. data/test/cgi/test.ru +0 -5
  100. data/test/gemloader.rb +0 -10
  101. data/test/helper.rb +0 -34
  102. data/test/multipart/bad_robots +0 -259
  103. data/test/multipart/binary +0 -0
  104. data/test/multipart/content_type_and_no_filename +0 -6
  105. data/test/multipart/empty +0 -10
  106. data/test/multipart/fail_16384_nofile +0 -814
  107. data/test/multipart/file1.txt +0 -1
  108. data/test/multipart/filename_and_modification_param +0 -7
  109. data/test/multipart/filename_and_no_name +0 -6
  110. data/test/multipart/filename_with_encoded_words +0 -7
  111. data/test/multipart/filename_with_escaped_quotes +0 -6
  112. data/test/multipart/filename_with_escaped_quotes_and_modification_param +0 -7
  113. data/test/multipart/filename_with_null_byte +0 -7
  114. data/test/multipart/filename_with_percent_escaped_quotes +0 -6
  115. data/test/multipart/filename_with_single_quote +0 -7
  116. data/test/multipart/filename_with_unescaped_percentages +0 -6
  117. data/test/multipart/filename_with_unescaped_percentages2 +0 -6
  118. data/test/multipart/filename_with_unescaped_percentages3 +0 -6
  119. data/test/multipart/filename_with_unescaped_quotes +0 -6
  120. data/test/multipart/ie +0 -6
  121. data/test/multipart/invalid_character +0 -6
  122. data/test/multipart/mixed_files +0 -21
  123. data/test/multipart/nested +0 -10
  124. data/test/multipart/none +0 -9
  125. data/test/multipart/quoted +0 -15
  126. data/test/multipart/rack-logo.png +0 -0
  127. data/test/multipart/semicolon +0 -6
  128. data/test/multipart/text +0 -15
  129. data/test/multipart/three_files_three_fields +0 -31
  130. data/test/multipart/unity3d_wwwform +0 -11
  131. data/test/multipart/webkit +0 -32
  132. data/test/rackup/config.ru +0 -31
  133. data/test/registering_handler/rack/handler/registering_myself.rb +0 -8
  134. data/test/spec_auth_basic.rb +0 -89
  135. data/test/spec_auth_digest.rb +0 -260
  136. data/test/spec_body_proxy.rb +0 -85
  137. data/test/spec_builder.rb +0 -233
  138. data/test/spec_cascade.rb +0 -63
  139. data/test/spec_cgi.rb +0 -84
  140. data/test/spec_chunked.rb +0 -103
  141. data/test/spec_common_logger.rb +0 -107
  142. data/test/spec_conditional_get.rb +0 -103
  143. data/test/spec_config.rb +0 -23
  144. data/test/spec_content_length.rb +0 -86
  145. data/test/spec_content_type.rb +0 -46
  146. data/test/spec_deflater.rb +0 -375
  147. data/test/spec_directory.rb +0 -148
  148. data/test/spec_etag.rb +0 -108
  149. data/test/spec_events.rb +0 -133
  150. data/test/spec_fastcgi.rb +0 -85
  151. data/test/spec_file.rb +0 -264
  152. data/test/spec_handler.rb +0 -57
  153. data/test/spec_head.rb +0 -46
  154. data/test/spec_lint.rb +0 -520
  155. data/test/spec_lobster.rb +0 -59
  156. data/test/spec_lock.rb +0 -204
  157. data/test/spec_logger.rb +0 -24
  158. data/test/spec_media_type.rb +0 -42
  159. data/test/spec_method_override.rb +0 -110
  160. data/test/spec_mime.rb +0 -51
  161. data/test/spec_mock.rb +0 -359
  162. data/test/spec_multipart.rb +0 -721
  163. data/test/spec_null_logger.rb +0 -21
  164. data/test/spec_recursive.rb +0 -75
  165. data/test/spec_request.rb +0 -1423
  166. data/test/spec_response.rb +0 -528
  167. data/test/spec_rewindable_input.rb +0 -128
  168. data/test/spec_runtime.rb +0 -50
  169. data/test/spec_sendfile.rb +0 -125
  170. data/test/spec_server.rb +0 -193
  171. data/test/spec_session_abstract_id.rb +0 -31
  172. data/test/spec_session_abstract_session_hash.rb +0 -45
  173. data/test/spec_session_cookie.rb +0 -442
  174. data/test/spec_session_memcache.rb +0 -357
  175. data/test/spec_session_persisted_secure_secure_session_hash.rb +0 -73
  176. data/test/spec_session_pool.rb +0 -247
  177. data/test/spec_show_exceptions.rb +0 -93
  178. data/test/spec_show_status.rb +0 -104
  179. data/test/spec_static.rb +0 -184
  180. data/test/spec_tempfile_reaper.rb +0 -64
  181. data/test/spec_thin.rb +0 -96
  182. data/test/spec_urlmap.rb +0 -237
  183. data/test/spec_utils.rb +0 -742
  184. data/test/spec_version.rb +0 -11
  185. data/test/spec_webrick.rb +0 -206
  186. data/test/static/another/index.html +0 -1
  187. data/test/static/foo.html +0 -1
  188. data/test/static/index.html +0 -1
  189. data/test/testrequest.rb +0 -78
  190. data/test/unregistered_handler/rack/handler/unregistered.rb +0 -7
  191. data/test/unregistered_handler/rack/handler/unregistered_long_one.rb +0 -7
data/HISTORY.md DELETED
@@ -1,520 +0,0 @@
1
- Thu Mar 2 14:50:46 2023 Aaron Patterson <tenderlove@ruby-lang.org>
2
-
3
- * [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
4
-
5
- Tue Jan 17 12:27:04 2023 Aaron Patterson <tenderlove@ruby-lang.org>
6
-
7
- * [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
8
- * [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
9
- * [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
10
-
11
- Fri May 27 08:27:04 2022 Aaron Patterson <tenderlove@ruby-lang.org>
12
-
13
- * [CVE-2022-30123] Fix shell escaping issue in Common Logger
14
- * [CVE-2022-30122] Restrict parsing of broken MIME attachments
15
-
16
- Sun Dec 4 18:48:03 2015 Jeremy Daer <jeremydaer@gmail.com>
17
-
18
- * First-party "SameSite" cookies. Browsers omit SameSite cookies
19
- from third-party requests, closing the door on many CSRF attacks.
20
-
21
- Pass `same_site: true` (or `:strict`) to enable:
22
- response.set_cookie 'foo', value: 'bar', same_site: true
23
- or `same_site: :lax` to use Lax enforcement:
24
- response.set_cookie 'foo', value: 'bar', same_site: :lax
25
-
26
- Based on version 7 of the Same-site Cookies internet draft:
27
- https://tools.ietf.org/html/draft-west-first-party-cookies-07
28
-
29
- Thanks to Ben Toews (@mastahyeti) and Bob Long (@bobjflong) for
30
- updating to drafts 5 and 7.
31
-
32
- Tue Nov 3 16:17:26 2015 Aaron Patterson <tenderlove@ruby-lang.org>
33
-
34
- * Add `Rack::Events` middleware for adding event based middleware:
35
- middleware that does not care about the response body, but only cares
36
- about doing work at particular points in the request / response
37
- lifecycle.
38
-
39
- Thu Oct 8 14:58:46 2015 Aaron Patterson <tenderlove@ruby-lang.org>
40
-
41
- * Add `Rack::Request#authority` to calculate the authority under which
42
- the response is being made (this will be handy for h2 pushes).
43
-
44
- Tue Oct 6 13:19:04 2015 Aaron Patterson <tenderlove@ruby-lang.org>
45
-
46
- * Add `Rack::Response::Helpers#cache_control` and `cache_control=`.
47
- Use this for setting cache control headers on your response objects.
48
-
49
- Tue Oct 6 13:12:21 2015 Aaron Patterson <tenderlove@ruby-lang.org>
50
-
51
- * Add `Rack::Response::Helpers#etag` and `etag=`. Use this for
52
- setting etag values on the response.
53
-
54
- Sun Oct 3 18:25:03 2015 Jeremy Daer <jeremydaer@gmail.com>
55
-
56
- * Introduce `Rack::Response::Helpers#add_header` to add a value to a
57
- multi-valued response header. Implemented in terms of other
58
- `Response#*_header` methods, so it's available to any response-like
59
- class that includes the `Helpers` module.
60
-
61
- * Add `Rack::Request#add_header` to match.
62
-
63
- Fri Sep 4 18:34:53 2015 Aaron Patterson <tenderlove@ruby-lang.org>
64
-
65
- * `Rack::Session::Abstract::ID` IS DEPRECATED. Please switch to
66
- `Rack::Session::Abstract::Persisted`.
67
- `Rack::Session::Abstract::Persisted` uses a request object rather than
68
- the `env` hash.
69
-
70
- Fri Sep 4 17:32:12 2015 Aaron Patterson <tenderlove@ruby-lang.org>
71
-
72
- * Pull `ENV` access inside the request object in to a module. This
73
- will help with legacy Request objects that are ENV based but don't
74
- want to inherit from Rack::Request
75
-
76
- Fri Sep 4 16:09:11 2015 Aaron Patterson <tenderlove@ruby-lang.org>
77
-
78
- * Move most methods on the `Rack::Request` to a module
79
- `Rack::Request::Helpers` and use public API to get values from the
80
- request object. This enables users to mix `Rack::Request::Helpers` in
81
- to their own objects so they can implement
82
- `(get|set|fetch|each)_header` as they see fit (for example a proxy
83
- object).
84
-
85
- Fri Sep 4 14:15:32 2015 Aaron Patterson <tenderlove@ruby-lang.org>
86
-
87
- * Files and directories with + in the name are served correctly.
88
- Rather than unescaping paths like a form, we unescape with a URI
89
- parser using `Rack::Utils.unescape_path`. Fixes #265
90
-
91
- Thu Aug 27 15:43:48 2015 Aaron Patterson <tenderlove@ruby-lang.org>
92
-
93
- * Tempfiles are automatically closed in the case that there were too
94
- many posted.
95
-
96
- Thu Aug 27 11:00:03 2015 Aaron Patterson <tenderlove@ruby-lang.org>
97
-
98
- * Added methods for manipulating response headers that don't assume
99
- they're stored as a Hash. Response-like classes may include the
100
- Rack::Response::Helpers module if they define these methods:
101
-
102
- * Rack::Response#has_header?
103
- * Rack::Response#get_header
104
- * Rack::Response#set_header
105
- * Rack::Response#delete_header
106
-
107
- Mon Aug 24 18:05:23 2015 Aaron Patterson <tenderlove@ruby-lang.org>
108
-
109
- * Introduce Util.get_byte_ranges that will parse the value of the
110
- HTTP_RANGE string passed to it without depending on the `env` hash.
111
- `byte_ranges` is deprecated in favor of this method.
112
-
113
- Sat Aug 22 17:49:49 2015 Aaron Patterson <tenderlove@ruby-lang.org>
114
-
115
- * Change Session internals to use Request objects for looking up
116
- session information. This allows us to only allocate one request
117
- object when dealing with session objects (rather than doing it every
118
- time we need to manipulate cookies, etc).
119
-
120
- Fri Aug 21 16:30:51 2015 Aaron Patterson <tenderlove@ruby-lang.org>
121
-
122
- * Add `Rack::Request#initialize_copy` so that the env is duped when
123
- the request gets duped.
124
-
125
- Thu Aug 20 16:20:58 2015 Aaron Patterson <tenderlove@ruby-lang.org>
126
-
127
- * Added methods for manipulating request specific data. This includes
128
- data set as CGI parameters, and just any arbitrary data the user wants
129
- to associate with a particular request. New methods:
130
-
131
- * Rack::Request#has_header?
132
- * Rack::Request#get_header
133
- * Rack::Request#fetch_header
134
- * Rack::Request#each_header
135
- * Rack::Request#set_header
136
- * Rack::Request#delete_header
137
-
138
- Thu Jun 18 16:00:05 2015 Aaron Patterson <tenderlove@ruby-lang.org>
139
-
140
- * lib/rack/utils.rb: add a method for constructing "delete" cookie
141
- headers. This allows us to construct cookie headers without depending
142
- on the side effects of mutating a hash.
143
-
144
- Fri Jun 12 11:37:41 2015 Aaron Patterson <tenderlove@ruby-lang.org>
145
-
146
- * Prevent extremely deep parameters from being parsed. CVE-2015-3225
147
-
148
- ### May 6th, 2015, Thirty seventh public release 1.6.1
149
- - Fix CVE-2014-9490, denial of service attack in OkJson ([8cd610](https://github.com/rack/rack/commit/8cd61062954f70e0a03e2855704e95ff4bdd4f6e))
150
- - Use a monotonic time for Rack::Runtime, if available ([d170b2](https://github.com/rack/rack/commit/d170b2363c949dce60871f9d5a6bfc83da2bedb5))
151
- - RACK_MULTIPART_LIMIT changed to RACK_MULTIPART_PART_LIMIT (RACK_MULTIPART_LIMIT is deprecated and will be removed in 1.7.0) ([c096c5](https://github.com/rack/rack/commit/c096c50c00230d8eee13ad5f79ad027d9a3f3ca9))
152
- - See the full [git history](https://github.com/rack/rack/compare/1.6.0...1.6.1) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.6%22)
153
-
154
- ### May 6th, 2015, Thirty seventh public release 1.5.3
155
- - Fix CVE-2014-9490, denial of service attack in OkJson ([99f725](https://github.com/rack/rack/commit/99f725b583b357376ffbb7b3b042c5daa3106ad6))
156
- - Backport bug fixes to 1.5 series ([#585](https://github.com/rack/rack/pull/585), [#711](https://github.com/rack/rack/pull/711), [#756](https://github.com/rack/rack/pull/756))
157
- - See the full [git history](https://github.com/rack/rack/compare/1.5.2...1.5.3) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.5.3%22)
158
-
159
- ### December 18th, 2014, Thirty sixth public release 1.6.0
160
- - Response#unauthorized? helper ([#580](https://github.com/rack/rack/pull/580))
161
- - Deflater now accepts an options hash to control compression on a per-request level ([#457](https://github.com/rack/rack/pull/457))
162
- - Builder#warmup method for app preloading ([#617](https://github.com/rack/rack/pull/617))
163
- - Request#accept_language method to extract HTTP_ACCEPT_LANGUAGE ([#623](https://github.com/rack/rack/pull/623))
164
- - Add quiet mode of rack server, rackup --quiet ([#674](https://github.com/rack/rack/pull/674))
165
- - Update HTTP Status Codes to RFC 7231 ([#754](https://github.com/rack/rack/pull/754))
166
- - Less strict header name validation according to [RFC 2616](https://tools.ietf.org/html/rfc2616) ([#399](https://github.com/rack/rack/pull/399))
167
- - SPEC updated to specify headers conform to RFC7230 specification ([6839fc](https://github.com/rack/rack/commit/6839fc203339f021cb3267fb09cba89410f086e9))
168
- - Etag correctly marks etags as weak ([#681](https://github.com/rack/rack/issues/681))
169
- - Request#port supports multiple x-http-forwarded-proto values ([#669](https://github.com/rack/rack/pull/669))
170
- - Utils#multipart_part_limit configures the maximum number of parts a request can contain ([#684](https://github.com/rack/rack/pull/684))
171
- - Default host to localhost when in development mode ([#514](https://github.com/rack/rack/pull/514))
172
- - Various bugfixes and performance improvements (See the full [git history](https://github.com/rack/rack/compare/1.5.2...1.6.0) and [milestone tag](https://github.com/rack/rack/issues?utf8=%E2%9C%93&q=milestone%3A%22Rack+1.6%22))
173
-
174
- ### February 7th, 2013, Thirty fifth public release 1.5.2
175
- - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
176
- - Fix CVE-2013-0262, symlink path traversal in Rack::File
177
- - Add various methods to Session for enhanced Rails compatibility
178
- - Request#trusted_proxy? now only matches whole stirngs
179
- - Add JSON cookie coder, to be default in Rack 1.6+ due to security concerns
180
- - URLMap host matching in environments that don't set the Host header fixed
181
- - Fix a race condition that could result in overwritten pidfiles
182
- - Various documentation additions
183
-
184
- ### February 7th, 2013, Thirty fifth public release 1.4.5
185
- - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
186
- - Fix CVE-2013-0262, symlink path traversal in Rack::File
187
-
188
- ### February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10
189
- - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
190
-
191
- ### January 28th, 2013: Thirty fourth public release 1.5.1
192
- - Rack::Lint check_hijack now conforms to other parts of SPEC
193
- - Added hash-like methods to Abstract::ID::SessionHash for compatibility
194
- - Various documentation corrections
195
-
196
- ### January 21st, 2013: Thirty third public release 1.5.0
197
- - Introduced hijack SPEC, for before-response and after-response hijacking
198
- - SessionHash is no longer a Hash subclass
199
- - Rack::File cache_control parameter is removed, in place of headers options
200
- - Rack::Auth::AbstractRequest#scheme now yields strings, not symbols
201
- - Rack::Utils cookie functions now format expires in RFC 2822 format
202
- - Rack::File now has a default mime type
203
- - rackup -b 'run Rack::File.new(".")', option provides command line configs
204
- - Rack::Deflater will no longer double encode bodies
205
- - Rack::Mime#match? provides convenience for Accept header matching
206
- - Rack::Utils#q_values provides splitting for Accept headers
207
- - Rack::Utils#best_q_match provides a helper for Accept headers
208
- - Rack::Handler.pick provides convenience for finding available servers
209
- - Puma added to the list of default servers (preferred over Webrick)
210
- - Various middleware now correctly close body when replacing it
211
- - Rack::Request#params is no longer persistent with only GET params
212
- - Rack::Request#update_param and #delete_param provide persistent operations
213
- - Rack::Request#trusted_proxy? now returns true for local unix sockets
214
- - Rack::Response no longer forces Content-Types
215
- - Rack::Sendfile provides local mapping configuration options
216
- - Rack::Utils#rfc2109 provides old netscape style time output
217
- - Updated HTTP status codes
218
- - Ruby 1.8.6 likely no longer passes tests, and is no longer fully supported
219
-
220
- ### January 13th, 2013: Thirty second public release 1.4.4, 1.3.9, 1.2.7, 1.1.5
221
- - [SEC] Rack::Auth::AbstractRequest no longer symbolizes arbitrary strings
222
- - Fixed erroneous test case in the 1.3.x series
223
-
224
- ### January 7th, 2013: Thirty first public release 1.4.3
225
- - Security: Prevent unbounded reads in large multipart boundaries
226
-
227
- ### January 7th, 2013: Thirtieth public release 1.3.8
228
- - Security: Prevent unbounded reads in large multipart boundaries
229
-
230
- ### January 6th, 2013: Twenty ninth public release 1.4.2
231
- - Add warnings when users do not provide a session secret
232
- - Fix parsing performance for unquoted filenames
233
- - Updated URI backports
234
- - Fix URI backport version matching, and silence constant warnings
235
- - Correct parameter parsing with empty values
236
- - Correct rackup '-I' flag, to allow multiple uses
237
- - Correct rackup pidfile handling
238
- - Report rackup line numbers correctly
239
- - Fix request loops caused by non-stale nonces with time limits
240
- - Fix reloader on Windows
241
- - Prevent infinite recursions from Response#to_ary
242
- - Various middleware better conforms to the body close specification
243
- - Updated language for the body close specification
244
- - Additional notes regarding ECMA escape compatibility issues
245
- - Fix the parsing of multiple ranges in range headers
246
- - Prevent errors from empty parameter keys
247
- - Added PATCH verb to Rack::Request
248
- - Various documentation updates
249
- - Fix session merge semantics (fixes rack-test)
250
- - Rack::Static :index can now handle multiple directories
251
- - All tests now utilize Rack::Lint (special thanks to Lars Gierth)
252
- - Rack::File cache_control parameter is now deprecated, and removed by 1.5
253
- - Correct Rack::Directory script name escaping
254
- - Rack::Static supports header rules for sophisticated configurations
255
- - Multipart parsing now works without a Content-Length header
256
- - New logos courtesy of Zachary Scott!
257
- - Rack::BodyProxy now explicitly defines #each, useful for C extensions
258
- - Cookies that are not URI escaped no longer cause exceptions
259
-
260
- ### January 6th, 2013: Twenty eighth public release 1.3.7
261
- - Add warnings when users do not provide a session secret
262
- - Fix parsing performance for unquoted filenames
263
- - Updated URI backports
264
- - Fix URI backport version matching, and silence constant warnings
265
- - Correct parameter parsing with empty values
266
- - Correct rackup '-I' flag, to allow multiple uses
267
- - Correct rackup pidfile handling
268
- - Report rackup line numbers correctly
269
- - Fix request loops caused by non-stale nonces with time limits
270
- - Fix reloader on Windows
271
- - Prevent infinite recursions from Response#to_ary
272
- - Various middleware better conforms to the body close specification
273
- - Updated language for the body close specification
274
- - Additional notes regarding ECMA escape compatibility issues
275
- - Fix the parsing of multiple ranges in range headers
276
-
277
- ### January 6th, 2013: Twenty seventh public release 1.2.6
278
- - Add warnings when users do not provide a session secret
279
- - Fix parsing performance for unquoted filenames
280
-
281
- ### January 6th, 2013: Twenty sixth public release 1.1.4
282
- - Add warnings when users do not provide a session secret
283
-
284
- ### January 22nd, 2012: Twenty fifth public release 1.4.1
285
- - Alter the keyspace limit calculations to reduce issues with nested params
286
- - Add a workaround for multipart parsing where files contain unescaped "%"
287
- - Added Rack::Response::Helpers#method_not_allowed? (code 405)
288
- - Rack::File now returns 404 for illegal directory traversals
289
- - Rack::File now returns 405 for illegal methods (non HEAD/GET)
290
- - Rack::Cascade now catches 405 by default, as well as 404
291
- - Cookies missing '--' no longer cause an exception to be raised
292
- - Various style changes and documentation spelling errors
293
- - Rack::BodyProxy always ensures to execute its block
294
- - Additional test coverage around cookies and secrets
295
- - Rack::Session::Cookie can now be supplied either secret or old_secret
296
- - Tests are no longer dependent on set order
297
- - Rack::Static no longer defaults to serving index files
298
- - Rack.release was fixed
299
-
300
- ### December 28th, 2011: Twenty fourth public release 1.4.0
301
- - Ruby 1.8.6 support has officially been dropped. Not all tests pass.
302
- - Raise sane error messages for broken config.ru
303
- - Allow combining run and map in a config.ru
304
- - Rack::ContentType will not set Content-Type for responses without a body
305
- - Status code 205 does not send a response body
306
- - Rack::Response::Helpers will not rely on instance variables
307
- - Rack::Utils.build_query no longer outputs '=' for nil query values
308
- - Various mime types added
309
- - Rack::MockRequest now supports HEAD
310
- - Rack::Directory now supports files that contain RFC3986 reserved chars
311
- - Rack::File now only supports GET and HEAD requests
312
- - Rack::Server#start now passes the block to Rack::Handler::<h>#run
313
- - Rack::Static now supports an index option
314
- - Added the Teapot status code
315
- - rackup now defaults to Thin instead of Mongrel (if installed)
316
- - Support added for HTTP_X_FORWARDED_SCHEME
317
- - Numerous bug fixes, including many fixes for new and alternate rubies
318
-
319
- ### December 28th, 2011: Twenty first public release: 1.1.3.
320
- - Security fix. http://www.ocert.org/advisories/ocert-2011-003.html
321
- Further information here: http://jruby.org/2011/12/27/jruby-1-6-5-1
322
-
323
- ### October 17, 2011: Twentieth public release 1.3.5
324
- - Fix annoying warnings caused by the backport in 1.3.4
325
-
326
- ### October 1, 2011: Nineteenth public release 1.3.4
327
- - Backport security fix from 1.9.3, also fixes some roundtrip issues in URI
328
- - Small documentation update
329
- - Fix an issue where BodyProxy could cause an infinite recursion
330
- - Add some supporting files for travis-ci
331
-
332
- ### September 16, 2011: Eighteenth public release 1.2.4
333
- - Fix a bug with MRI regex engine to prevent XSS by malformed unicode
334
-
335
- ### September 16, 2011: Seventeenth public release 1.3.3
336
- - Fix bug with broken query parameters in Rack::ShowExceptions
337
- - Rack::Request#cookies no longer swallows exceptions on broken input
338
- - Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
339
- - Rack::ConditionalGet handles broken If-Modified-Since helpers
340
-
341
- ### July 16, 2011: Sixteenth public release 1.3.2
342
- - Fix for Rails and rack-test, Rack::Utils#escape calls to_s
343
-
344
- ### July 13, 2011: Fifteenth public release 1.3.1
345
- - Fix 1.9.1 support
346
- - Fix JRuby support
347
- - Properly handle $KCODE in Rack::Utils.escape
348
- - Make method_missing/respond_to behavior consistent for Rack::Lock,
349
- Rack::Auth::Digest::Request and Rack::Multipart::UploadedFile
350
- - Reenable passing rack.session to session middleware
351
- - Rack::CommonLogger handles streaming responses correctly
352
- - Rack::MockResponse calls close on the body object
353
- - Fix a DOS vector from MRI stdlib backport
354
-
355
- ### May 22nd, 2011: Fourteenth public release 1.2.3
356
- - Pulled in relevant bug fixes from 1.3
357
- - Fixed 1.8.6 support
358
-
359
- ### May 22nd, 2011: Thirteenth public release 1.3.0
360
- - Various performance optimizations
361
- - Various multipart fixes
362
- - Various multipart refactors
363
- - Infinite loop fix for multipart
364
- - Test coverage for Rack::Server returns
365
- - Allow files with '..', but not path components that are '..'
366
- - rackup accepts handler-specific options on the command line
367
- - Request#params no longer merges POST into GET (but returns the same)
368
- - Use URI.encode_www_form_component instead. Use core methods for escaping.
369
- - Allow multi-line comments in the config file
370
- - Bug L#94 reported by Nikolai Lugovoi, query parameter unescaping.
371
- - Rack::Response now deletes Content-Length when appropriate
372
- - Rack::Deflater now supports streaming
373
- - Improved Rack::Handler loading and searching
374
- - Support for the PATCH verb
375
- - env['rack.session.options'] now contains session options
376
- - Cookies respect renew
377
- - Session middleware uses SecureRandom.hex
378
-
379
- ### March 13th, 2011: Twelfth public release 1.2.2/1.1.2.
380
- - Security fix in Rack::Auth::Digest::MD5: when authenticator
381
- returned nil, permission was granted on empty password.
382
-
383
- ### June 15th, 2010: Eleventh public release 1.2.1.
384
- - Make CGI handler rewindable
385
- - Rename spec/ to test/ to not conflict with SPEC on lesser
386
- operating systems
387
-
388
- ### June 13th, 2010: Tenth public release 1.2.0.
389
- - Removed Camping adapter: Camping 2.0 supports Rack as-is
390
- - Removed parsing of quoted values
391
- - Add Request.trace? and Request.options?
392
- - Add mime-type for .webm and .htc
393
- - Fix HTTP_X_FORWARDED_FOR
394
- - Various multipart fixes
395
- - Switch test suite to bacon
396
-
397
- ### January 3rd, 2010: Ninth public release 1.1.0.
398
- - Moved Auth::OpenID to rack-contrib.
399
- - SPEC change that relaxes Lint slightly to allow subclasses of the
400
- required types
401
- - SPEC change to document rack.input binary mode in greator detail
402
- - SPEC define optional rack.logger specification
403
- - File servers support X-Cascade header
404
- - Imported Config middleware
405
- - Imported ETag middleware
406
- - Imported Runtime middleware
407
- - Imported Sendfile middleware
408
- - New Logger and NullLogger middlewares
409
- - Added mime type for .ogv and .manifest.
410
- - Don't squeeze PATH_INFO slashes
411
- - Use Content-Type to determine POST params parsing
412
- - Update Rack::Utils::HTTP_STATUS_CODES hash
413
- - Add status code lookup utility
414
- - Response should call #to_i on the status
415
- - Add Request#user_agent
416
- - Request#host knows about forwared host
417
- - Return an empty string for Request#host if HTTP_HOST and
418
- SERVER_NAME are both missing
419
- - Allow MockRequest to accept hash params
420
- - Optimizations to HeaderHash
421
- - Refactored rackup into Rack::Server
422
- - Added Utils.build_nested_query to complement Utils.parse_nested_query
423
- - Added Utils::Multipart.build_multipart to complement
424
- Utils::Multipart.parse_multipart
425
- - Extracted set and delete cookie helpers into Utils so they can be
426
- used outside Response
427
- - Extract parse_query and parse_multipart in Request so subclasses
428
- can change their behavior
429
- - Enforce binary encoding in RewindableInput
430
- - Set correct external_encoding for handlers that don't use RewindableInput
431
-
432
- ### October 18th, 2009: Eighth public release 1.0.1.
433
- - Bump remainder of rack.versions.
434
- - Support the pure Ruby FCGI implementation.
435
- - Fix for form names containing "=": split first then unescape components
436
- - Fixes the handling of the filename parameter with semicolons in names.
437
- - Add anchor to nested params parsing regexp to prevent stack overflows
438
- - Use more compatible gzip write api instead of "<<".
439
- - Make sure that Reloader doesn't break when executed via ruby -e
440
- - Make sure WEBrick respects the :Host option
441
- - Many Ruby 1.9 fixes.
442
-
443
- ### April 25th, 2009: Seventh public release 1.0.0.
444
- - SPEC change: Rack::VERSION has been pushed to [1,0].
445
- - SPEC change: header values must be Strings now, split on "\n".
446
- - SPEC change: Content-Length can be missing, in this case chunked transfer
447
- encoding is used.
448
- - SPEC change: rack.input must be rewindable and support reading into
449
- a buffer, wrap with Rack::RewindableInput if it isn't.
450
- - SPEC change: rack.session is now specified.
451
- - SPEC change: Bodies can now additionally respond to #to_path with
452
- a filename to be served.
453
- - NOTE: String bodies break in 1.9, use an Array consisting of a
454
- single String instead.
455
- - New middleware Rack::Lock.
456
- - New middleware Rack::ContentType.
457
- - Rack::Reloader has been rewritten.
458
- - Major update to Rack::Auth::OpenID.
459
- - Support for nested parameter parsing in Rack::Response.
460
- - Support for redirects in Rack::Response.
461
- - HttpOnly cookie support in Rack::Response.
462
- - The Rakefile has been rewritten.
463
- - Many bugfixes and small improvements.
464
-
465
- ### January 9th, 2009: Sixth public release 0.9.1.
466
- - Fix directory traversal exploits in Rack::File and Rack::Directory.
467
-
468
- ### January 6th, 2009: Fifth public release 0.9.
469
- - Rack is now managed by the Rack Core Team.
470
- - Rack::Lint is stricter and follows the HTTP RFCs more closely.
471
- - Added ConditionalGet middleware.
472
- - Added ContentLength middleware.
473
- - Added Deflater middleware.
474
- - Added Head middleware.
475
- - Added MethodOverride middleware.
476
- - Rack::Mime now provides popular MIME-types and their extension.
477
- - Mongrel Header now streams.
478
- - Added Thin handler.
479
- - Official support for swiftiplied Mongrel.
480
- - Secure cookies.
481
- - Made HeaderHash case-preserving.
482
- - Many bugfixes and small improvements.
483
-
484
- ### August 21st, 2008: Fourth public release 0.4.
485
- - New middleware, Rack::Deflater, by Christoffer Sawicki.
486
- - OpenID authentication now needs ruby-openid 2.
487
- - New Memcache sessions, by blink.
488
- - Explicit EventedMongrel handler, by Joshua Peek <josh@joshpeek.com>
489
- - Rack::Reloader is not loaded in rackup development mode.
490
- - rackup can daemonize with -D.
491
- - Many bugfixes, especially for pool sessions, URLMap, thread safety
492
- and tempfile handling.
493
- - Improved tests.
494
- - Rack moved to Git.
495
-
496
- ### February 26th, 2008: Third public release 0.3.
497
- - LiteSpeed handler, by Adrian Madrid.
498
- - SCGI handler, by Jeremy Evans.
499
- - Pool sessions, by blink.
500
- - OpenID authentication, by blink.
501
- - :Port and :File options for opening FastCGI sockets, by blink.
502
- - Last-Modified HTTP header for Rack::File, by blink.
503
- - Rack::Builder#use now accepts blocks, by Corey Jewett.
504
- (See example/protectedlobster.ru)
505
- - HTTP status 201 can contain a Content-Type and a body now.
506
- - Many bugfixes, especially related to Cookie handling.
507
-
508
- ### May 16th, 2007: Second public release 0.2.
509
- - HTTP Basic authentication.
510
- - Cookie Sessions.
511
- - Static file handler.
512
- - Improved Rack::Request.
513
- - Improved Rack::Response.
514
- - Added Rack::ShowStatus, for better default error messages.
515
- - Bug fixes in the Camping adapter.
516
- - Removed Rails adapter, was too alpha.
517
-
518
- ### March 3rd, 2007: First public release 0.1.
519
-
520
- /* vim: set filetype=changelog */
@@ -1,5 +0,0 @@
1
- class AnUnderscoreApp
2
- def self.call(env)
3
- [200, {'Content-Type' => 'text/plain'}, ['OK']]
4
- end
5
- end
@@ -1,5 +0,0 @@
1
- class Anything
2
- def self.call(env)
3
- [200, {'Content-Type' => 'text/plain'}, ['OK']]
4
- end
5
- end
@@ -1,4 +0,0 @@
1
- =begin
2
-
3
- =end
4
- run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['OK']] }
data/test/builder/end.ru DELETED
@@ -1,5 +0,0 @@
1
- run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['OK']] }
2
- __END__
3
- Should not be evaluated
4
- Neither should
5
- This
data/test/builder/line.ru DELETED
@@ -1 +0,0 @@
1
- run lambda{ |env| [200, {'Content-Type' => 'text/plain'}, [__LINE__.to_s]] }
@@ -1,2 +0,0 @@
1
- #\ -d -p 2929 --env test
2
- run lambda { |env| [200, {'Content-Type' => 'text/plain'}, ['OK']] }
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1 +0,0 @@
1
- ### TestFile ###
@@ -1,26 +0,0 @@
1
- server.modules = ("mod_fastcgi", "mod_cgi")
2
- server.document-root = "."
3
- server.errorlog = var.CWD + "/lighttpd.errors"
4
- server.port = 9203
5
- server.bind = "127.0.0.1"
6
-
7
- server.event-handler = "select"
8
-
9
- cgi.assign = ("/test" => "",
10
- # ".ru" => ""
11
- )
12
-
13
- fastcgi.server = (
14
- "test.fcgi" => ("localhost" =>
15
- ("min-procs" => 1,
16
- "socket" => "/tmp/rack-test-fcgi",
17
- "bin-path" => "test.fcgi")),
18
- "test.ru" => ("localhost" =>
19
- ("min-procs" => 1,
20
- "socket" => "/tmp/rack-test-ru-fcgi",
21
- "bin-path" => CWD + "/rackup_stub.rb test.ru")),
22
- "sample_rackup.ru" => ("localhost" =>
23
- ("min-procs" => 1,
24
- "socket" => "/tmp/rack-test-rackup-fcgi",
25
- "bin-path" => CWD + "/rackup_stub.rb sample_rackup.ru")),
26
- )
@@ -1,6 +0,0 @@
1
- #!/usr/bin/env ruby
2
- # -*- ruby -*-
3
-
4
- $:.unshift '../../lib'
5
- require 'rack'
6
- Rack::Server.start
@@ -1,5 +0,0 @@
1
- # -*- ruby -*-
2
-
3
- require '../testrequest'
4
-
5
- run Rack::Lint.new(TestRequest.new)
data/test/cgi/test DELETED
@@ -1,9 +0,0 @@
1
- #!/usr/bin/env ruby
2
- # -*- ruby -*-
3
-
4
- $: << File.join(File.dirname(__FILE__), "..", "..", "lib")
5
-
6
- require 'rack'
7
- require '../testrequest'
8
-
9
- Rack::Handler::CGI.run(Rack::Lint.new(TestRequest.new))
@@ -1 +0,0 @@
1
- this file has plusses!
data/test/cgi/test.fcgi DELETED
@@ -1,9 +0,0 @@
1
- #!/usr/bin/env ruby
2
- # -*- ruby -*-
3
-
4
- require 'uri'
5
- $:.unshift '../../lib'
6
- require 'rack'
7
- require '../testrequest'
8
-
9
- Rack::Handler::FastCGI.run(Rack::Lint.new(TestRequest.new))
data/test/cgi/test.gz DELETED
Binary file
data/test/cgi/test.ru DELETED
@@ -1,5 +0,0 @@
1
- #!../../bin/rackup
2
- # -*- ruby -*-
3
-
4
- require '../testrequest'
5
- run Rack::Lint.new(TestRequest.new)
data/test/gemloader.rb DELETED
@@ -1,10 +0,0 @@
1
- require 'rubygems'
2
- project = 'rack'
3
- gemspec = File.expand_path("#{project}.gemspec", Dir.pwd)
4
- Gem::Specification.load(gemspec).dependencies.each do |dep|
5
- begin
6
- gem dep.name, *dep.requirement.as_list
7
- rescue Gem::LoadError
8
- warn "Cannot load #{dep.name} #{dep.requirement.to_s}"
9
- end
10
- end