rack 2.2.5 → 2.2.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26084bedd3bf39b7c3d6a93f3777803071b1938399819adc9751f8c9cca489e6
-  data.tar.gz: ab602081c775f3f42f089103caf22eccd8a9e83a0b5ef46c35c68cf509e1f856
+  metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
+  data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
 SHA512:
-  metadata.gz: 3f5b1557dd80e1c9e469d48ec769b6c4d6227a26ea38b0cda631804a69a92e662af5c95acf074d97e9dc693d137952a8b97dc7c5e1d9dbfa5159a66f676d4ceb
-  data.tar.gz: b16a3d1cbcfcef5eade1ce514546708af50765b35c44c69c3aec7ce2a92a477da7da692dfec9e07b4429beffb6b8625d363db5dfdbd672472adc161dfeccc0a3
+  metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
+  data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.6.1] - 2022-01-17
+
+- [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
+- [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
+- [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
+
+## [2.2.6] - 2022-01-17
+
+- Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
+
 ## [2.2.5] - 2022-12-27
 
 ### Fixed

data/lib/rack/method_override.rb

@@ -43,7 +43,7 @@ module Rack
 
     def method_override_param(req)
       req.POST[METHOD_OVERRIDE_PARAM_KEY]
-    rescue Utils::InvalidParameterError, Utils::ParameterTypeError
+    rescue Utils::InvalidParameterError, Utils::ParameterTypeError, QueryParser::ParamsTooDeepError
       req.get_header(RACK_ERRORS).puts "Invalid or incomplete POST params"
     rescue EOFError
       req.get_header(RACK_ERRORS).puts "Bad request content body"

data/lib/rack/multipart.rb

@@ -18,10 +18,10 @@ module Rack
     VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
     BROKEN = /^#{CONDISP}.*;\s*filename=(#{VALUE})/i
     MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
-    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*;\s*name=(#{VALUE})/ni
+    MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:[^:]*;\s*name=(#{VALUE})/ni
     MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
     # Updated definitions from RFC 2231
-    ATTRIBUTE_CHAR = %r{[^ \t\v\n\r)(><@,;:\\"/\[\]?='*%]}
+    ATTRIBUTE_CHAR = %r{[^ \x00-\x1f\x7f)(><@,;:\\"/\[\]?='*%]}
     ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
     SECTION = /\*[0-9]+/
     REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.5"
+  RELEASE = "2.2.6.1"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.5
+  version: 2.2.6.1
 platform: ruby
 authors:
 - Leah Neukirchen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-26 00:00:00.000000000 Z
+date: 2023-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: A modular Ruby webserver interface.