rack 2.2.23 → 2.2.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1956bc102141711f91a9f0daa1507098bd8b7ede58febde9472b875dcb0d4e4
-  data.tar.gz: a8945afc610aed0c61ce8062e3b1394a24c6a457789637cc6835cfd881dac635
+  metadata.gz: c5322ca41af487959f08981c9964d7ef877f82b0ee4374e4338bedbeb93d3538
+  data.tar.gz: 4accf7c52defac80efd55caef60ef967f1a813743d8487723e733f66591fce5d
 SHA512:
-  metadata.gz: afe4c41e29d6112ba8fe825b33b93d10317d576add705a72de25825caa504c21eefe86cf9308df573dd422cfb4aed24e9453ad4e92720188f4f98c4d2f04c5c4
-  data.tar.gz: d28cd489644e2191917b28f39d689d384c21296e4f4a8a2bab7b1413f4110cb2092336039afc571d1278adbbfa4ebac9b2d27cb342b873336aa6efe037a93f4d
+  metadata.gz: 4b5cedb21343a2e062ca5daf8c55f88fe29bc7d884244dcd13ca6cad858e61764b18f71ea93cfb6a538bc03dadbb82ad7471895d1f6cbc1b2bc727651a807a11
+  data.tar.gz: 5bc5a948d20e77d1c831173b4ba5ba5b661bc985f60a6bf9fd1224033c6725ed2c8753f39766a3fe386b56457de9439ace3459cd0f1f650dd0c7fdb2effdcc13

data/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.25] - 2026-10-30
+
+### Security
+
+- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
+- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them.
+- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
+
+### Fixed
+
+- Multipart parser: scan boundary lines with a literal newline search instead of a backtracking regexp, which allocated tens of megabytes per scan for long lines and made the scan buffer fix above ineffective on this series.
+
+## [2.2.24] - 2026-08-13
+
+### Security
+
+- [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
+
 ## [2.2.23] - 2026-04-01
 
 ### Security

data/lib/rack/multipart/parser.rb

@@ -20,10 +20,17 @@ module Rack
 
       BOUNDARY_REGEX = /\A([^\n]*(?:\n|\Z))/
 
+      LINE_END = /\n/
+      private_constant :LINE_END
+
       BOUNDARY_START_LIMIT = 16 * 1024
       private_constant :BOUNDARY_START_LIMIT
 
       MIME_HEADER_BYTESIZE_LIMIT = 64 * 1024
+
+      OBS_UNFOLD = /\r\n([ \t])/
+
+      private_constant :OBS_UNFOLD
       private_constant :MIME_HEADER_BYTESIZE_LIMIT
 
       env_int = lambda do |key, val|
@@ -89,7 +96,11 @@ module Rack
         unless data[1].empty?
           raise EOFError, "whitespace between boundary parameter name and equal sign"
         end
-        if data.post_match =~ /boundary\s*=/i
+        # Count across the whole header rather than only after the match: the
+        # lazy prefix in MULTIPART can skip a first boundary parameter whose
+        # value is empty or starts with a quote, semicolon, or comma. Also
+        # count RFC 2231 boundary* parameters, which some parsers prefer.
+        if content_type.scan(/boundary(?:\*\d*\*?)?\s*=/i).size > 1
           raise EOFError, "multiple boundary parameters found in multipart content type"
         end
 
@@ -310,14 +321,17 @@ module Rack
       def handle_mime_head
         if @sbuf.scan_until(@head_regex)
           head = @sbuf[1]
-          content_type = head[MULTIPART_CONTENT_TYPE, 1]
-          if name = head[MULTIPART_CONTENT_DISPOSITION, 1]
+          # Implement OBS unfolding (RFC 5322 Section 2.2.3). Done on a copy
+          # because content type, disposition and filename are extracted by regex.
+          unfolded_head = head.gsub(OBS_UNFOLD, '\\1')
+          content_type = unfolded_head[MULTIPART_CONTENT_TYPE, 1]
+          if name = unfolded_head[MULTIPART_CONTENT_DISPOSITION, 1]
             name = Rack::Auth::Digest::Params::dequote(name)
           else
-            name = head[MULTIPART_CONTENT_ID, 1]
+            name = unfolded_head[MULTIPART_CONTENT_ID, 1]
           end
 
-          filename = get_filename(head)
+          filename = get_filename(unfolded_head)
 
           if name.nil? || name.empty?
             name = filename || "#{content_type || TEXT_PLAIN}[]".dup
@@ -339,6 +353,7 @@ module Rack
           # buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default)
           raise EOFError, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT
 
+          @sbuf.string = @sbuf.rest
           return :want_read
         end
       end
@@ -359,8 +374,8 @@ module Rack
             update_retained_size(body.bytesize) if @body_retained
             @collector.on_mime_body @mime_index, body
             @sbuf.pos += delta
-            @sbuf.string = @sbuf.rest
           end
+          @sbuf.string = @sbuf.rest
           :want_read
         end
       end
@@ -379,7 +394,7 @@ module Rack
       # end of the boundary.  If we don't find the start or end of the
       # boundary, clear the buffer and return nil.
       def consume_boundary
-        while read_buffer = @sbuf.scan_until(BOUNDARY_REGEX)
+        while read_buffer = scan_line
           case read_buffer.strip
           when full_boundary then return :BOUNDARY
           when @end_boundary then return :END_BOUNDARY
@@ -388,6 +403,21 @@ module Rack
         end
       end
 
+      # Return the next line of the buffer including its trailing "\n", or the
+      # rest of the buffer if it contains no "\n", and advance past it. This is
+      # equivalent to `@sbuf.scan_until(BOUNDARY_REGEX)`, but searching for the
+      # "\n" directly avoids the regexp engine's backtracking stack, which grows
+      # by one entry per byte matched by `[^\n]*` (tens of MB for a 1 MB line).
+      def scan_line
+        if line = @sbuf.scan_until(LINE_END)
+          line
+        else
+          line = @sbuf.rest
+          @sbuf.terminate
+          line
+        end
+      end
+
       def get_filename(head)
         filename = nil
         case head

data/lib/rack/static.rb

@@ -168,7 +168,7 @@ module Rack
 
     # Convert HTTP header rules to HTTP headers
     def applicable_rules(path)
-      path = ::Rack::Utils.unescape_path(path)
+      path = ::Rack::Utils.clean_path_info(::Rack::Utils.unescape_path(path))
 
       @header_rules.find_all do |rule, new_headers|
         case rule

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.23"
+  RELEASE = "2.2.25"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.23
+  version: 2.2.25
 platform: ruby
 authors:
 - Leah Neukirchen
@@ -182,7 +182,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []