rack 2.1.4 → 2.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3851dcf1bb18356cc36d8d390c8b2f7e9abde5a7068dac862246e8280a9d7c41
-  data.tar.gz: 5a5b9b318ba267f8ac3bd726048e6e826ff3feed3bb150252df91c7d038951cc
+  metadata.gz: 328f3d4ad7c94b2662ae35cc3633d67060bac8f0acf2728c414094a3c0c3c001
+  data.tar.gz: 00f0493d8fa4c8393059d9b3d8da2e0e6401cec2e734daee5ee9c806648a3878
 SHA512:
-  metadata.gz: 7d071738226e954ce7bf0507422e41857bba7a10ceed70c22263b279cbbd19d362066a6ac62999a47212878f7e26e659e396c6c6ee51eb5dc4d5617a41859597
-  data.tar.gz: 2d0ff8ec9f7fe54a4c0d88fd4ae51424b506df4c9a15324830ea36961dda8e5327250637f8b0a4168d4f66e95c815d0f2cc773c56f5a70dcadf5d50491723614
+  metadata.gz: d2987fc196b4eb837e26917c2b8deadfbbd58ff3909a6e12acf3e9bef334d1d0da36bf1d08f10054bee2b57e4e2872dd64964d73ce225cdf028402ec5d52db05
+  data.tar.gz: e6276012db31f2c93f433d40c9d3be4beb7999d974d9d1f33eb830d4a4953f6e94840533917dd2e0eddd73e9d95e71f56a3fa72599f70796ecf88fe88677fcd1

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## [2.1.4.1] - 2022-05-27
+
+- [CVE-2022-30123] Fix shell escaping issue in Common Logger
+- [CVE-2022-30122] Restrict parsing of broken MIME attachments
+
 ## [2.1.4] - 2020-06-15
 
 - [CVE-2020-8184] When parsing cookies, only decode the value

data/lib/rack/common_logger.rb

@@ -55,7 +55,10 @@ module Rack
         length,
         Utils.clock_time - began_at ]
 
+      msg.gsub!(/[^[:print:]\n]/) { |c| "\\x#{c.ord}" }
+
       logger = @logger || env[RACK_ERRORS]
+
       # Standard library logger doesn't support write but it supports << which actually
       # calls to write on the log device without formatting
       if logger.respond_to?(:write)

data/lib/rack/lint.rb

@@ -296,7 +296,7 @@ module Rack
       check_hijack env
 
       ## * The <tt>REQUEST_METHOD</tt> must be a valid token.
-      assert("REQUEST_METHOD unknown: #{env[REQUEST_METHOD]}") {
+      assert("REQUEST_METHOD unknown: #{env[REQUEST_METHOD].dump}") {
         env[REQUEST_METHOD] =~ /\A[0-9A-Za-z!\#$%&'*+.^_`|~-]+\z/
       }
 

data/lib/rack/multipart/parser.rb

@@ -309,8 +309,9 @@ module Rack
           elsif filename = params['filename*']
             encoding, _, filename = filename.split("'", 3)
           end
-        when BROKEN_QUOTED, BROKEN_UNQUOTED
+        when BROKEN
           filename = $1
+          filename = $1 if filename =~ /^"(.*)"$/
         end
 
         return unless filename

data/lib/rack/multipart.rb

@@ -16,8 +16,7 @@ module Rack
     TOKEN = /[^\s()<>,;:\\"\/\[\]?=]+/
     CONDISP = /Content-Disposition:\s*#{TOKEN}\s*/i
     VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
-    BROKEN_QUOTED = /^#{CONDISP}.*;\s*filename="(.*?)"(?:\s*$|\s*;\s*#{TOKEN}=)/i
-    BROKEN_UNQUOTED = /^#{CONDISP}.*;\s*filename=(#{TOKEN})/i
+    BROKEN = /^#{CONDISP}.*;\s*filename=(#{VALUE})/i
     MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
     MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*;\s*name=(#{VALUE})/ni
     MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni

data/lib/rack.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.1.4"
+  RELEASE = "2.1.4.1"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.1.4
+  version: 2.1.4.1
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-15 00:00:00.000000000 Z
+date: 2022-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -170,7 +170,7 @@ metadata:
   homepage_uri: https://rack.github.io
   mailing_list_uri: https://groups.google.com/forum/#!forum/rack-devel
   source_code_uri: https://github.com/rack/rack
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -185,8 +185,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.0.pre1
-signing_key:
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: a modular Ruby webserver interface
 test_files: []