rack 2.2.6.2 → 2.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58f641d1882668bf5e150710676e3067def0089d87706cf4b233b11eb5e36cc7
-  data.tar.gz: 1ea7a963d41498945e0377b9637ca37df23c9fa41139e83517b37de512be41d7
+  metadata.gz: 9f923ec1a763c61e0a56fd1e54a81e588f0fc397c59d14c8b671f95280072f41
+  data.tar.gz: 6fdfe8427a897c706fe136e1428e984a8c0997ad08134ebc5a8f81ee3156b614
 SHA512:
-  metadata.gz: cafc52d78b4b998df9a973915ccd925de929d9b3b263369c76d3c3efb46d636752dd7260947507c3b4a5a51bab628c007567ef5e5b0759b8b59753ecab93c0f3
-  data.tar.gz: c161e73e76fea22a0ef5b4c53c747a63591975c417e426697694d399f204806e6e39ff45e382f7f1938b3c8add90f4492c0c5d754d57685cfc12b486b8ef897f
+  metadata.gz: 3365984fb627b727ccb7915037604aa22dca0d1bc5df50f9c58e58bf2e4849217ad0adb1c890332cc2b228c77ca466dc1c802eab89204859c4b7e4aa3d244c32
+  data.tar.gz: 0f3f0d1ae09128f7f3c589978cdefc0ff614d07b4a10ce1748d9311cd62c3b9ce4ebb754084aa16900e052d98474be8479a76d56700edc3c17ac7d61562ee4b1

data/CHANGELOG.md

@@ -2,16 +2,24 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## [2.2.6.2] - 2022-01-17
+## [2.2.6.4] - 2023-03-13
+
+- [CVE-2023-27539] Avoid ReDoS in header parsing
+
+## [2.2.6.3] - 2023-03-02
+
+- [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
+
+## [2.2.6.2] - 2023-01-17
 
 - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
 
-## [2.2.6.1] - 2022-01-17
+## [2.2.6.1] - 2023-01-17
 
 - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
 - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
 
-## [2.2.6] - 2022-01-17
+## [2.2.6] - 2023-01-17
 
 - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
 

data/README.rdoc

@@ -202,16 +202,30 @@ Limiting the depth prevents a possible stack overflow when parsing parameters.
 
 Defaults to 100.
 
-=== multipart_part_limit
+=== multipart_file_limit
 
-The maximum number of parts a request can contain.
+The maximum number of parts with a filename a request can contain.
 Accepting too many part can lead to the server running out of file handles.
 
 The default is 128, which means that a single request can't upload more than 128 files at once.
 
 Set to 0 for no limit.
 
-Can also be set via the +RACK_MULTIPART_PART_LIMIT+ environment variable.
+Can also be set via the +RACK_MULTIPART_FILE_LIMIT+ environment variable.
+
+(This is also aliased as +multipart_part_limit+ and +RACK_MULTIPART_PART_LIMIT+ for compatibility)
+
+=== multipart_total_part_limit
+
+The maximum total number of parts a request can contain of any type, including
+both file and non-file form fields.
+
+The default is 4096, which means that a single request can't contain more than
+4096 parts.
+
+Set to 0 for no limit.
+
+Can also be set via the +RACK_MULTIPART_TOTAL_PART_LIMIT+ environment variable.
 
 == Changelog
 

data/lib/rack/multipart/parser.rb

@@ -5,6 +5,7 @@ require 'strscan'
 module Rack
   module Multipart
     class MultipartPartLimitError < Errno::EMFILE; end
+    class MultipartTotalPartLimitError < StandardError; end
 
     class Parser
       (require_relative '../core_ext/regexp'; using ::Rack::RegexpExtensions) if RUBY_VERSION < '2.4'
@@ -140,7 +141,7 @@ module Rack
 
           @mime_parts[mime_index] = klass.new(body, head, filename, content_type, name)
 
-          check_open_files
+          check_part_limits
         end
 
         def on_mime_body(mime_index, content)
@@ -152,13 +153,23 @@ module Rack
 
         private
 
-        def check_open_files
-          if Utils.multipart_part_limit > 0
-            if @open_files >= Utils.multipart_part_limit
+        def check_part_limits
+          file_limit = Utils.multipart_file_limit
+          part_limit = Utils.multipart_total_part_limit
+
+          if file_limit && file_limit > 0
+            if @open_files >= file_limit
               @mime_parts.each(&:close)
               raise MultipartPartLimitError, 'Maximum file multiparts in content reached'
             end
           end
+
+          if part_limit && part_limit > 0
+            if @mime_parts.size >= part_limit
+              @mime_parts.each(&:close)
+              raise MultipartTotalPartLimitError, 'Maximum total multiparts in content reached'
+            end
+          end
         end
       end
 

data/lib/rack/request.rb

@@ -572,8 +572,8 @@ module Rack
       end
 
       def parse_http_accept_header(header)
-        header.to_s.split(/\s*,\s*/).map do |part|
-          attribute, parameters = part.split(/\s*;\s*/, 2)
+        header.to_s.split(",").each(&:strip!).map do |part|
+          attribute, parameters = part.split(";", 2).each(&:strip!)
           quality = 1.0
           if parameters and /\Aq=([\d.]+)/ =~ parameters
             quality = $1.to_f
@@ -608,7 +608,7 @@ module Rack
           (?<ip4>[\d\.]+)
           |
           # A hostname:
-          (?<name>[a-zA-Z0-9\.\-]+)
+          (?<name>[a-zA-Z0-9\.\-_]+)
         )
         # The optional port:
         (:(?<port>\d+))?

data/lib/rack/utils.rb

@@ -58,13 +58,24 @@ module Rack
     end
 
     class << self
-      attr_accessor :multipart_part_limit
+      attr_accessor :multipart_total_part_limit
+
+      attr_accessor :multipart_file_limit
+
+      # multipart_part_limit is the original name of multipart_file_limit, but
+      # the limit only counts parts with filenames.
+      alias multipart_part_limit multipart_file_limit
+      alias multipart_part_limit= multipart_file_limit=
     end
 
-    # The maximum number of parts a request can contain. Accepting too many part
-    # can lead to the server running out of file handles.
+    # The maximum number of file parts a request can contain. Accepting too
+    # many parts can lead to the server running out of file handles.
     # Set to `0` for no limit.
-    self.multipart_part_limit = (ENV['RACK_MULTIPART_PART_LIMIT'] || 128).to_i
+    self.multipart_file_limit = (ENV['RACK_MULTIPART_PART_LIMIT'] || ENV['RACK_MULTIPART_FILE_LIMIT'] || 128).to_i
+
+    # The maximum total number of parts a request can contain. Accepting too
+    # many can lead to excessive memory use and parsing time.
+    self.multipart_total_part_limit = (ENV['RACK_MULTIPART_TOTAL_PART_LIMIT'] || 4096).to_i
 
     def self.param_depth_limit
       default_query_parser.param_depth_limit

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.6.2"
+  RELEASE = "2.2.7"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.6.2
+  version: 2.2.7
 platform: ruby
 authors:
 - Leah Neukirchen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-17 00:00:00.000000000 Z
+date: 2023-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.0.dev
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: A modular Ruby webserver interface.