rack 2.2.5 → 2.2.6.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 26084bedd3bf39b7c3d6a93f3777803071b1938399819adc9751f8c9cca489e6
4
- data.tar.gz: ab602081c775f3f42f089103caf22eccd8a9e83a0b5ef46c35c68cf509e1f856
3
+ metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
4
+ data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
5
5
  SHA512:
6
- metadata.gz: 3f5b1557dd80e1c9e469d48ec769b6c4d6227a26ea38b0cda631804a69a92e662af5c95acf074d97e9dc693d137952a8b97dc7c5e1d9dbfa5159a66f676d4ceb
7
- data.tar.gz: b16a3d1cbcfcef5eade1ce514546708af50765b35c44c69c3aec7ce2a92a477da7da692dfec9e07b4429beffb6b8625d363db5dfdbd672472adc161dfeccc0a3
6
+ metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
7
+ data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40
data/CHANGELOG.md CHANGED
@@ -2,6 +2,16 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [2.2.6.1] - 2022-01-17
6
+
7
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
8
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
9
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
10
+
11
+ ## [2.2.6] - 2022-01-17
12
+
13
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
14
+
5
15
  ## [2.2.5] - 2022-12-27
6
16
 
7
17
  ### Fixed
@@ -43,7 +43,7 @@ module Rack
43
43
 
44
44
  def method_override_param(req)
45
45
  req.POST[METHOD_OVERRIDE_PARAM_KEY]
46
- rescue Utils::InvalidParameterError, Utils::ParameterTypeError
46
+ rescue Utils::InvalidParameterError, Utils::ParameterTypeError, QueryParser::ParamsTooDeepError
47
47
  req.get_header(RACK_ERRORS).puts "Invalid or incomplete POST params"
48
48
  rescue EOFError
49
49
  req.get_header(RACK_ERRORS).puts "Bad request content body"
@@ -18,10 +18,10 @@ module Rack
18
18
  VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
19
19
  BROKEN = /^#{CONDISP}.*;\s*filename=(#{VALUE})/i
20
20
  MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
21
- MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*;\s*name=(#{VALUE})/ni
21
+ MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:[^:]*;\s*name=(#{VALUE})/ni
22
22
  MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
23
23
  # Updated definitions from RFC 2231
24
- ATTRIBUTE_CHAR = %r{[^ \t\v\n\r)(><@,;:\\"/\[\]?='*%]}
24
+ ATTRIBUTE_CHAR = %r{[^ \x00-\x1f\x7f)(><@,;:\\"/\[\]?='*%]}
25
25
  ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
26
26
  SECTION = /\*[0-9]+/
27
27
  REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/
data/lib/rack/version.rb CHANGED
@@ -20,7 +20,7 @@ module Rack
20
20
  VERSION.join(".")
21
21
  end
22
22
 
23
- RELEASE = "2.2.5"
23
+ RELEASE = "2.2.6.1"
24
24
 
25
25
  # Return the Rack release as a dotted string.
26
26
  def self.release
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rack
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.2.5
4
+ version: 2.2.6.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Leah Neukirchen
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-12-26 00:00:00.000000000 Z
11
+ date: 2023-01-17 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: minitest
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
184
184
  - !ruby/object:Gem::Version
185
185
  version: '0'
186
186
  requirements: []
187
- rubygems_version: 3.3.7
187
+ rubygems_version: 3.1.6
188
188
  signing_key:
189
189
  specification_version: 4
190
190
  summary: A modular Ruby webserver interface.