rack 2.2.6.2 → 2.2.7

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of rack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 58f641d1882668bf5e150710676e3067def0089d87706cf4b233b11eb5e36cc7
4
- data.tar.gz: 1ea7a963d41498945e0377b9637ca37df23c9fa41139e83517b37de512be41d7
3
+ metadata.gz: 9f923ec1a763c61e0a56fd1e54a81e588f0fc397c59d14c8b671f95280072f41
4
+ data.tar.gz: 6fdfe8427a897c706fe136e1428e984a8c0997ad08134ebc5a8f81ee3156b614
5
5
  SHA512:
6
- metadata.gz: cafc52d78b4b998df9a973915ccd925de929d9b3b263369c76d3c3efb46d636752dd7260947507c3b4a5a51bab628c007567ef5e5b0759b8b59753ecab93c0f3
7
- data.tar.gz: c161e73e76fea22a0ef5b4c53c747a63591975c417e426697694d399f204806e6e39ff45e382f7f1938b3c8add90f4492c0c5d754d57685cfc12b486b8ef897f
6
+ metadata.gz: 3365984fb627b727ccb7915037604aa22dca0d1bc5df50f9c58e58bf2e4849217ad0adb1c890332cc2b228c77ca466dc1c802eab89204859c4b7e4aa3d244c32
7
+ data.tar.gz: 0f3f0d1ae09128f7f3c589978cdefc0ff614d07b4a10ce1748d9311cd62c3b9ce4ebb754084aa16900e052d98474be8479a76d56700edc3c17ac7d61562ee4b1
data/CHANGELOG.md CHANGED
@@ -2,16 +2,24 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
- ## [2.2.6.2] - 2022-01-17
5
+ ## [2.2.6.4] - 2023-03-13
6
+
7
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
8
+
9
+ ## [2.2.6.3] - 2023-03-02
10
+
11
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
12
+
13
+ ## [2.2.6.2] - 2023-01-17
6
14
 
7
15
  - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
8
16
 
9
- ## [2.2.6.1] - 2022-01-17
17
+ ## [2.2.6.1] - 2023-01-17
10
18
 
11
19
  - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
12
20
  - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
13
21
 
14
- ## [2.2.6] - 2022-01-17
22
+ ## [2.2.6] - 2023-01-17
15
23
 
16
24
  - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
17
25
 
data/README.rdoc CHANGED
@@ -202,16 +202,30 @@ Limiting the depth prevents a possible stack overflow when parsing parameters.
202
202
 
203
203
  Defaults to 100.
204
204
 
205
- === multipart_part_limit
205
+ === multipart_file_limit
206
206
 
207
- The maximum number of parts a request can contain.
207
+ The maximum number of parts with a filename a request can contain.
208
208
  Accepting too many part can lead to the server running out of file handles.
209
209
 
210
210
  The default is 128, which means that a single request can't upload more than 128 files at once.
211
211
 
212
212
  Set to 0 for no limit.
213
213
 
214
- Can also be set via the +RACK_MULTIPART_PART_LIMIT+ environment variable.
214
+ Can also be set via the +RACK_MULTIPART_FILE_LIMIT+ environment variable.
215
+
216
+ (This is also aliased as +multipart_part_limit+ and +RACK_MULTIPART_PART_LIMIT+ for compatibility)
217
+
218
+ === multipart_total_part_limit
219
+
220
+ The maximum total number of parts a request can contain of any type, including
221
+ both file and non-file form fields.
222
+
223
+ The default is 4096, which means that a single request can't contain more than
224
+ 4096 parts.
225
+
226
+ Set to 0 for no limit.
227
+
228
+ Can also be set via the +RACK_MULTIPART_TOTAL_PART_LIMIT+ environment variable.
215
229
 
216
230
  == Changelog
217
231
 
@@ -5,6 +5,7 @@ require 'strscan'
5
5
  module Rack
6
6
  module Multipart
7
7
  class MultipartPartLimitError < Errno::EMFILE; end
8
+ class MultipartTotalPartLimitError < StandardError; end
8
9
 
9
10
  class Parser
10
11
  (require_relative '../core_ext/regexp'; using ::Rack::RegexpExtensions) if RUBY_VERSION < '2.4'
@@ -140,7 +141,7 @@ module Rack
140
141
 
141
142
  @mime_parts[mime_index] = klass.new(body, head, filename, content_type, name)
142
143
 
143
- check_open_files
144
+ check_part_limits
144
145
  end
145
146
 
146
147
  def on_mime_body(mime_index, content)
@@ -152,13 +153,23 @@ module Rack
152
153
 
153
154
  private
154
155
 
155
- def check_open_files
156
- if Utils.multipart_part_limit > 0
157
- if @open_files >= Utils.multipart_part_limit
156
+ def check_part_limits
157
+ file_limit = Utils.multipart_file_limit
158
+ part_limit = Utils.multipart_total_part_limit
159
+
160
+ if file_limit && file_limit > 0
161
+ if @open_files >= file_limit
158
162
  @mime_parts.each(&:close)
159
163
  raise MultipartPartLimitError, 'Maximum file multiparts in content reached'
160
164
  end
161
165
  end
166
+
167
+ if part_limit && part_limit > 0
168
+ if @mime_parts.size >= part_limit
169
+ @mime_parts.each(&:close)
170
+ raise MultipartTotalPartLimitError, 'Maximum total multiparts in content reached'
171
+ end
172
+ end
162
173
  end
163
174
  end
164
175
 
data/lib/rack/request.rb CHANGED
@@ -572,8 +572,8 @@ module Rack
572
572
  end
573
573
 
574
574
  def parse_http_accept_header(header)
575
- header.to_s.split(/\s*,\s*/).map do |part|
576
- attribute, parameters = part.split(/\s*;\s*/, 2)
575
+ header.to_s.split(",").each(&:strip!).map do |part|
576
+ attribute, parameters = part.split(";", 2).each(&:strip!)
577
577
  quality = 1.0
578
578
  if parameters and /\Aq=([\d.]+)/ =~ parameters
579
579
  quality = $1.to_f
@@ -608,7 +608,7 @@ module Rack
608
608
  (?<ip4>[\d\.]+)
609
609
  |
610
610
  # A hostname:
611
- (?<name>[a-zA-Z0-9\.\-]+)
611
+ (?<name>[a-zA-Z0-9\.\-_]+)
612
612
  )
613
613
  # The optional port:
614
614
  (:(?<port>\d+))?
data/lib/rack/utils.rb CHANGED
@@ -58,13 +58,24 @@ module Rack
58
58
  end
59
59
 
60
60
  class << self
61
- attr_accessor :multipart_part_limit
61
+ attr_accessor :multipart_total_part_limit
62
+
63
+ attr_accessor :multipart_file_limit
64
+
65
+ # multipart_part_limit is the original name of multipart_file_limit, but
66
+ # the limit only counts parts with filenames.
67
+ alias multipart_part_limit multipart_file_limit
68
+ alias multipart_part_limit= multipart_file_limit=
62
69
  end
63
70
 
64
- # The maximum number of parts a request can contain. Accepting too many part
65
- # can lead to the server running out of file handles.
71
+ # The maximum number of file parts a request can contain. Accepting too
72
+ # many parts can lead to the server running out of file handles.
66
73
  # Set to `0` for no limit.
67
- self.multipart_part_limit = (ENV['RACK_MULTIPART_PART_LIMIT'] || 128).to_i
74
+ self.multipart_file_limit = (ENV['RACK_MULTIPART_PART_LIMIT'] || ENV['RACK_MULTIPART_FILE_LIMIT'] || 128).to_i
75
+
76
+ # The maximum total number of parts a request can contain. Accepting too
77
+ # many can lead to excessive memory use and parsing time.
78
+ self.multipart_total_part_limit = (ENV['RACK_MULTIPART_TOTAL_PART_LIMIT'] || 4096).to_i
68
79
 
69
80
  def self.param_depth_limit
70
81
  default_query_parser.param_depth_limit
data/lib/rack/version.rb CHANGED
@@ -20,7 +20,7 @@ module Rack
20
20
  VERSION.join(".")
21
21
  end
22
22
 
23
- RELEASE = "2.2.6.2"
23
+ RELEASE = "2.2.7"
24
24
 
25
25
  # Return the Rack release as a dotted string.
26
26
  def self.release
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rack
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.2.6.2
4
+ version: 2.2.7
5
5
  platform: ruby
6
6
  authors:
7
7
  - Leah Neukirchen
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2023-01-17 00:00:00.000000000 Z
11
+ date: 2023-04-24 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: minitest
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
184
184
  - !ruby/object:Gem::Version
185
185
  version: '0'
186
186
  requirements: []
187
- rubygems_version: 3.5.0.dev
187
+ rubygems_version: 3.4.10
188
188
  signing_key:
189
189
  specification_version: 4
190
190
  summary: A modular Ruby webserver interface.