rack 2.2.10 → 2.2.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89c25f75ddd66c4ab311ec7afaad215f5417ab7c0478fb8da65bef7288b25ead
-  data.tar.gz: 35bef5623220a06f4f1f54a752c0d5d67b23539d9521470446a323a03b25b3fa
+  metadata.gz: 167bba569cfd7b2335f6e17741862befa9de899c21e0c77dbf86973204528196
+  data.tar.gz: ce06a5a6bfbb34b51c107192549bbfb8eefc01c46f73f16dce244881648440cb
 SHA512:
-  metadata.gz: 82b9812778a5e19704f7014a87b5dccffea6122e7a55295cfff5bfc2a581a11d718af4282b1503dc63bd16984ab286367da26ba533081dd7453c5c44d37a3616
-  data.tar.gz: e7231940003fac65c76d7ed327e4f90d3b2ab31f665651e609a607e37952a43ced1b764429f052fef431e849f2bbc6a8841141ce4c51ac898d6bd34f54660b8e
+  metadata.gz: 35279519ce7d3543c348083fa24359880421b3fc3ac77a3390baf48df15ec84ab83ff4dd38d9ea33e1f013bbdeb623ff5f1a7c858ed914d4e81ca2c3bbf06fa1
+  data.tar.gz: 32759f2fbb97edff9fb17d081ea618ae062b3b267e74d953037f56fa8387fecd46eec393bca57eabd282b94c187e9586cac6ff4b1ed6d3d97b4280046f0f61a2

data/CHANGELOG.md

@@ -2,7 +2,17 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## Unreleased
+## [2.2.12] - 2025-03-04
+
+### Security
+
+- [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
+
+## [2.2.11] - 2025-02-12
+
+### Security
+
+- [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
 
 ## [2.2.10] - 2024-10-14
 

data/lib/rack/common_logger.rb

@@ -15,7 +15,7 @@ module Rack
     # The actual format is slightly different than the above due to the
     # separation of SCRIPT_NAME and PATH_INFO, and because the elapsed
     # time in seconds is included at the end.
-    FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f\n}
+    FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f }
 
     # +logger+ can be any object that supports the +write+ or +<<+ methods,
     # which includes the standard library Logger.  These methods are called
@@ -60,7 +60,8 @@ module Rack
         length,
         Utils.clock_time - began_at ]
 
-      msg.gsub!(/[^[:print:]\n]/) { |c| "\\x#{c.ord}" }
+      msg.gsub!(/[^[:print:]]/) { |c| sprintf("\\x%x", c.ord) }
+      msg[-1] = "\n"
 
       logger = @logger || env[RACK_ERRORS]
 

data/lib/rack/sendfile.rb

@@ -133,7 +133,7 @@ module Rack
           end
         when '', nil
         else
-          env[RACK_ERRORS].puts "Unknown x-sendfile variation: '#{type}'.\n"
+          env[RACK_ERRORS].puts "Unknown x-sendfile variation: #{type.inspect}"
         end
       end
       [status, headers, body]

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.10"
+  RELEASE = "2.2.12"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.10
+  version: 2.2.12
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-14 00:00:00.000000000 Z
+date: 2025-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -169,7 +168,6 @@ metadata:
   changelog_uri: https://github.com/rack/rack/blob/master/CHANGELOG.md
   documentation_uri: https://rubydoc.info/github/rack/rack
   source_code_uri: https://github.com/rack/rack
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -184,8 +182,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []