rack 2.2.4 → 2.2.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 562d6b2cb433ea758545c29074629d82b364bf197dfab096c1821ffb72928e3c
-  data.tar.gz: 5adf005621955c2a5a524f966603c2d8c0f7cf640f6fff4439d024a921f69c4a
+  metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
+  data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
 SHA512:
-  metadata.gz: c8a134688af4df517e1483bca22c63582e5b29d6d4f2b71c11b220ee57642d046a4188038a45d02e20357b6823c7938c57aa45fd88f504732a76b58c6bf70eb7
-  data.tar.gz: 81164557b5a8e25d35ff7f2e2889ea7e6eb04df8a23b42513fdcffa7d85dfd07f925372c703f5bf6a9a1fea2f3b842de5565cb0608d713b4cfe81440007e1d2e
+  metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
+  data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.6.1] - 2022-01-17
+
+- [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
+- [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
+- [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
+
+## [2.2.6] - 2022-01-17
+
+- Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
+
+## [2.2.5] - 2022-12-27
+
+### Fixed
+
+- `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
+
 ## [2.2.4] - 2022-06-30
 
 - Better support for lower case headers in `Rack::ETag` middleware. ([#1919](https://github.com/rack/rack/pull/1919), [@ioquatix](https://github.com/ioquatix))

data/lib/rack/method_override.rb

@@ -43,7 +43,7 @@ module Rack
 
     def method_override_param(req)
       req.POST[METHOD_OVERRIDE_PARAM_KEY]
-    rescue Utils::InvalidParameterError, Utils::ParameterTypeError
+    rescue Utils::InvalidParameterError, Utils::ParameterTypeError, QueryParser::ParamsTooDeepError
       req.get_header(RACK_ERRORS).puts "Invalid or incomplete POST params"
     rescue EOFError
       req.get_header(RACK_ERRORS).puts "Bad request content body"

data/lib/rack/multipart.rb

@@ -18,10 +18,10 @@ module Rack
     VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
     BROKEN = /^#{CONDISP}.*;\s*filename=(#{VALUE})/i
     MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
-    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*;\s*name=(#{VALUE})/ni
+    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:[^:]*;\s*name=(#{VALUE})/ni
     MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
     # Updated definitions from RFC 2231
-    ATTRIBUTE_CHAR = %r{[^ \t\v\n\r)(><@,;:\\"/\[\]?='*%]}
+    ATTRIBUTE_CHAR = %r{[^ \x00-\x1f\x7f)(><@,;:\\"/\[\]?='*%]}
     ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
     SECTION = /\*[0-9]+/
     REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/

data/lib/rack/urlmap.rb

@@ -35,7 +35,7 @@ module Rack
         end
 
         location = location.chomp('/')
-        match = Regexp.new("^#{Regexp.quote(location).gsub('/', '/+')}(.*)", nil, 'n')
+        match = Regexp.new("^#{Regexp.quote(location).gsub('/', '/+')}(.*)", Regexp::NOENCODING)
 
         [host, location, match, app]
       }.sort_by do |(host, location, _, _)|

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.4"
+  RELEASE = "2.2.6.1"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.4
+  version: 2.2.6.1
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-06-30 00:00:00.000000000 Z
+date: 2023-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -169,7 +169,7 @@ metadata:
   changelog_uri: https://github.com/rack/rack/blob/master/CHANGELOG.md
   documentation_uri: https://rubydoc.info/github/rack/rack
   source_code_uri: https://github.com/rack/rack
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -184,8 +184,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []