rack 2.2.24 → 2.2.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5905364bd5b40d622e2e10330911370ec92f23e5afa1aa58283c2f0cf9a5782d
-  data.tar.gz: '09c4da33251a32194f0a656767150eaa17367f8e42ee45735971e963d0e43991'
+  metadata.gz: c5322ca41af487959f08981c9964d7ef877f82b0ee4374e4338bedbeb93d3538
+  data.tar.gz: 4accf7c52defac80efd55caef60ef967f1a813743d8487723e733f66591fce5d
 SHA512:
-  metadata.gz: 5ee4b678c01a6bb97074b87886498d8aa3bce9b61322cb95cc7908dec5e751fdfb8b238bc98956719505b394de21d1f6787d2593378b1fee4a6fe10b9aea3d5b
-  data.tar.gz: 032c32c7ebb220355578577fce8ad49c67f869b0ba60e533c3e1178b3265086d50e34de0912f00dc9bfdfb4042d446bc2b1ac8bc62916835521b4cf3786de341
+  metadata.gz: 4b5cedb21343a2e062ca5daf8c55f88fe29bc7d884244dcd13ca6cad858e61764b18f71ea93cfb6a538bc03dadbb82ad7471895d1f6cbc1b2bc727651a807a11
+  data.tar.gz: 5bc5a948d20e77d1c831173b4ba5ba5b661bc985f60a6bf9fd1224033c6725ed2c8753f39766a3fe386b56457de9439ace3459cd0f1f650dd0c7fdb2effdcc13

data/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.25] - 2026-10-30
+
+### Security
+
+- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
+- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them.
+- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
+
+### Fixed
+
+- Multipart parser: scan boundary lines with a literal newline search instead of a backtracking regexp, which allocated tens of megabytes per scan for long lines and made the scan buffer fix above ineffective on this series.
+
 ## [2.2.24] - 2026-08-13
 
 ### Security

data/lib/rack/multipart/parser.rb

@@ -20,6 +20,9 @@ module Rack
 
       BOUNDARY_REGEX = /\A([^\n]*(?:\n|\Z))/
 
+      LINE_END = /\n/
+      private_constant :LINE_END
+
       BOUNDARY_START_LIMIT = 16 * 1024
       private_constant :BOUNDARY_START_LIMIT
 
@@ -93,7 +96,11 @@ module Rack
         unless data[1].empty?
           raise EOFError, "whitespace between boundary parameter name and equal sign"
         end
-        if data.post_match =~ /boundary\s*=/i
+        # Count across the whole header rather than only after the match: the
+        # lazy prefix in MULTIPART can skip a first boundary parameter whose
+        # value is empty or starts with a quote, semicolon, or comma. Also
+        # count RFC 2231 boundary* parameters, which some parsers prefer.
+        if content_type.scan(/boundary(?:\*\d*\*?)?\s*=/i).size > 1
           raise EOFError, "multiple boundary parameters found in multipart content type"
         end
 
@@ -346,6 +353,7 @@ module Rack
           # buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default)
           raise EOFError, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT
 
+          @sbuf.string = @sbuf.rest
           return :want_read
         end
       end
@@ -366,8 +374,8 @@ module Rack
             update_retained_size(body.bytesize) if @body_retained
             @collector.on_mime_body @mime_index, body
             @sbuf.pos += delta
-            @sbuf.string = @sbuf.rest
           end
+          @sbuf.string = @sbuf.rest
           :want_read
         end
       end
@@ -386,7 +394,7 @@ module Rack
       # end of the boundary.  If we don't find the start or end of the
       # boundary, clear the buffer and return nil.
       def consume_boundary
-        while read_buffer = @sbuf.scan_until(BOUNDARY_REGEX)
+        while read_buffer = scan_line
           case read_buffer.strip
           when full_boundary then return :BOUNDARY
           when @end_boundary then return :END_BOUNDARY
@@ -395,6 +403,21 @@ module Rack
         end
       end
 
+      # Return the next line of the buffer including its trailing "\n", or the
+      # rest of the buffer if it contains no "\n", and advance past it. This is
+      # equivalent to `@sbuf.scan_until(BOUNDARY_REGEX)`, but searching for the
+      # "\n" directly avoids the regexp engine's backtracking stack, which grows
+      # by one entry per byte matched by `[^\n]*` (tens of MB for a 1 MB line).
+      def scan_line
+        if line = @sbuf.scan_until(LINE_END)
+          line
+        else
+          line = @sbuf.rest
+          @sbuf.terminate
+          line
+        end
+      end
+
       def get_filename(head)
         filename = nil
         case head

data/lib/rack/static.rb

@@ -168,7 +168,7 @@ module Rack
 
     # Convert HTTP header rules to HTTP headers
     def applicable_rules(path)
-      path = ::Rack::Utils.unescape_path(path)
+      path = ::Rack::Utils.clean_path_info(::Rack::Utils.unescape_path(path))
 
       @header_rules.find_all do |rule, new_headers|
         case rule

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.24"
+  RELEASE = "2.2.25"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.24
+  version: 2.2.25
 platform: ruby
 authors:
 - Leah Neukirchen