rack 2.2.17 → 2.2.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/lib/rack/handler/thin.rb +0 -2
- data/lib/rack/query_parser.rb +1 -1
- data/lib/rack/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 2a0c02f8ad516a9e66e1d8ec32ca620dfe46328d5b248fb6a72ed0b8e4a0f91c
|
|
4
|
+
data.tar.gz: d32193586a1367c718a9a4385b26a4159a8e376c852c624fd9e1ad6b77e5137d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8ea04755b2f8c7d4482a35e601d5fdc73d1fd7f62fc0bade4cf6ce0769cbe7e182ec6c6659dddc44489069a19959a3d5fa799451573a38fb943f21376356329d
|
|
7
|
+
data.tar.gz: d8c8032d0fb15a750878a0d4127d79957f21890298b7dbdb743dc276ede56fb0a32b94ece434c7d6bea26bf55167b5318ffc9c0e4c0fe6f5d1baf0cadeba6ba5
|
data/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
|
|
4
4
|
|
|
5
|
+
## [2.2.18] - 2025-09-25
|
|
6
|
+
|
|
7
|
+
- [CVE-2025-59830](https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
|
|
8
|
+
|
|
5
9
|
## [2.2.17] - 2025-06-03
|
|
6
10
|
|
|
7
11
|
- Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
|
data/lib/rack/handler/thin.rb
CHANGED
|
@@ -15,8 +15,6 @@ module Rack
|
|
|
15
15
|
host = options.delete(:Host) || default_host
|
|
16
16
|
port = options.delete(:Port) || 8080
|
|
17
17
|
args = [host, port, app, options]
|
|
18
|
-
# Thin versions below 0.8.0 do not support additional options
|
|
19
|
-
args.pop if ::Thin::VERSION::MAJOR < 1 && ::Thin::VERSION::MINOR < 8
|
|
20
18
|
server = ::Thin::Server.new(*args)
|
|
21
19
|
yield server if block_given?
|
|
22
20
|
server.start
|
data/lib/rack/query_parser.rb
CHANGED
|
@@ -188,7 +188,7 @@ module Rack
|
|
|
188
188
|
raise QueryLimitError, "total query size (#{qs.bytesize}) exceeds limit (#{@bytesize_limit})"
|
|
189
189
|
end
|
|
190
190
|
|
|
191
|
-
if (param_count = qs.count(sep.is_a?(String) ? sep : '
|
|
191
|
+
if (param_count = qs.count(sep.is_a?(String) ? sep : '&;')) >= @params_limit
|
|
192
192
|
raise QueryLimitError, "total number of query parameters (#{param_count+1}) exceeds limit (#{@params_limit})"
|
|
193
193
|
end
|
|
194
194
|
|
data/lib/rack/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rack
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.2.
|
|
4
|
+
version: 2.2.18
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Leah Neukirchen
|
|
@@ -182,7 +182,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
182
182
|
- !ruby/object:Gem::Version
|
|
183
183
|
version: '0'
|
|
184
184
|
requirements: []
|
|
185
|
-
rubygems_version: 3.
|
|
185
|
+
rubygems_version: 3.6.9
|
|
186
186
|
specification_version: 4
|
|
187
187
|
summary: A modular Ruby webserver interface.
|
|
188
188
|
test_files: []
|