rack 3.0.18 → 3.1.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +198 -8
  3. data/CONTRIBUTING.md +11 -9
  4. data/README.md +42 -15
  5. data/SPEC.rdoc +38 -13
  6. data/lib/rack/auth/basic.rb +1 -2
  7. data/lib/rack/bad_request.rb +8 -0
  8. data/lib/rack/builder.rb +23 -10
  9. data/lib/rack/cascade.rb +0 -3
  10. data/lib/rack/constants.rb +3 -0
  11. data/lib/rack/headers.rb +86 -2
  12. data/lib/rack/lint.rb +118 -34
  13. data/lib/rack/logger.rb +2 -1
  14. data/lib/rack/media_type.rb +8 -3
  15. data/lib/rack/mime.rb +6 -5
  16. data/lib/rack/mock_request.rb +10 -15
  17. data/lib/rack/mock_response.rb +14 -16
  18. data/lib/rack/multipart/parser.rb +178 -66
  19. data/lib/rack/multipart.rb +34 -1
  20. data/lib/rack/query_parser.rb +16 -68
  21. data/lib/rack/request.rb +44 -22
  22. data/lib/rack/response.rb +28 -20
  23. data/lib/rack/sendfile.rb +50 -20
  24. data/lib/rack/show_exceptions.rb +6 -2
  25. data/lib/rack/utils.rb +71 -98
  26. data/lib/rack/version.rb +1 -14
  27. data/lib/rack.rb +1 -3
  28. metadata +5 -11
  29. data/lib/rack/auth/digest/md5.rb +0 -1
  30. data/lib/rack/auth/digest/nonce.rb +0 -1
  31. data/lib/rack/auth/digest/params.rb +0 -1
  32. data/lib/rack/auth/digest/request.rb +0 -1
  33. data/lib/rack/auth/digest.rb +0 -256
  34. data/lib/rack/chunked.rb +0 -120
  35. data/lib/rack/file.rb +0 -9
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c109b92a92a0fcc346c4fabc30223e1a29fec8d062f91c45791d4b2a4b411a2f
4
- data.tar.gz: 161c23b7fcfecad716e387db0946f07ceab0c5ff8616cc5c022ec8fafd097382
3
+ metadata.gz: 627b4fe8d3af482f544229eaa2a32868adf887decbc3616669646c0ecdb514e5
4
+ data.tar.gz: f5c0b0b49232d4dd4630e4ccf71f30a322bf7cf91f8e38711e9a203b2e2c03c7
5
5
  SHA512:
6
- metadata.gz: 5eb41a9d006fba6cdb3c272c74527896a6a3b5c9dc0b855a5ca06928ec50d182edfb23c6cf777ce77995d0d2f41a74440e59a48a301e12e1f99f5ca98cfda694
7
- data.tar.gz: 865ae1620806ea268231ce88b4b228d6bef477e37cd465dd8525d81c42fdd5eab0a75f3de21770a6209d25ed9e2a49be4cacbf5335e356af73cd831bbb64dd37
6
+ metadata.gz: 5f61477c3fc2f135ee874290de05f1c18c015fe9285348e5d673a41d86782bd00f61f83d8fea2a81af15158e3d87acea8c2edcf5600c7e292df79c2e40480f98
7
+ data.tar.gz: 6e22900f3d703d4db6d14e4a7960a52f835df19df2796cf1669e1c4415b4243a5e9097cf87ab1b37102090a98109408524ca6c2762a77f69eeda9755ed47aef1
data/CHANGELOG.md CHANGED
@@ -2,6 +2,168 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [3.1.18] - 2025-10-10
6
+
7
+ ### Security
8
+
9
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
10
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
11
+
12
+ ## [3.1.17] - 2025-10-07
13
+
14
+ ### Security
15
+
16
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
17
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
18
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
19
+
20
+ ## [3.1.16] - 2025-06-04
21
+
22
+ ### Security
23
+
24
+ - [CVE-2025-49007](https://github.com/advisories/GHSA-47m2-26rw-j2jw) Fix ReDoS in multipart request.
25
+
26
+ ## [3.1.15] - 2025-05-18
27
+
28
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
29
+
30
+ ## [3.1.14] - 2025-05-06
31
+
32
+ ### Security
33
+
34
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
35
+
36
+ ## [3.1.13] - 2025-04-13
37
+
38
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
39
+
40
+ ## [3.1.12] - 2025-03-11
41
+
42
+ ### Security
43
+
44
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
45
+
46
+ ## [3.1.11] - 2025-03-04
47
+
48
+ ### Security
49
+
50
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
51
+
52
+ ## [3.1.10] - 2025-02-12
53
+
54
+ ### Security
55
+
56
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
57
+
58
+ ## [3.1.9] - 2025-01-31
59
+
60
+ ### Fixed
61
+
62
+ - `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
63
+
64
+ ## [3.1.8] - 2024-10-14
65
+
66
+ ### Fixed
67
+
68
+ - Resolve deprecation warnings about uri `DEFAULT_PARSER`. ([#2249](https://github.com/rack/rack/pull/2249), [@earlopain])
69
+
70
+ ## [3.1.7] - 2024-07-11
71
+
72
+ ### Fixed
73
+
74
+ - Do not remove escaped opening/closing quotes for content-disposition filenames. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
75
+ - Fix encoding setting for non-binary IO-like objects in MockRequest#env_for. ([#2227](https://github.com/rack/rack/pull/2227), [@jeremyevans])
76
+ - `Rack::Response` should not generate invalid `content-length` header. ([#2219](https://github.com/rack/rack/pull/2219), [@ioquatix])
77
+ - Allow empty PATH_INFO. ([#2214](https://github.com/rack/rack/pull/2214), [@ioquatix])
78
+
79
+ ## [3.1.6] - 2024-07-03
80
+
81
+ ### Fixed
82
+
83
+ - Fix several edge cases in `Rack::Request#parse_http_accept_header`'s implementation. ([#2226](https://github.com/rack/rack/pull/2226), [@ioquatix])
84
+
85
+ ## [3.1.5] - 2024-07-02
86
+
87
+ ### Security
88
+
89
+ - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
90
+
91
+ ## [3.1.4] - 2024-06-22
92
+
93
+ ### Fixed
94
+
95
+ - Fix `Rack::Lint` matching some paths incorrectly as authority form. ([#2220](https://github.com/rack/rack/pull/2220), [@ioquatix])
96
+
97
+ ## [3.1.3] - 2024-06-12
98
+
99
+ ### Fixed
100
+
101
+ - Fix passing non-strings to `Rack::Utils.escape_html`. ([#2202](https://github.com/rack/rack/pull/2202), [@earlopain])
102
+ - `Rack::MockResponse` gracefully handles empty cookies ([#2203](https://github.com/rack/rack/pull/2203) [@wynksaiddestroy])
103
+
104
+ ## [3.1.2] - 2024-06-11
105
+
106
+ - `Rack::Response` will take in to consideration chunked encoding responses ([#2204](https://github.com/rack/rack/pull/2204), [@tenderlove])
107
+
108
+ ## [3.1.1] - 2024-06-11
109
+
110
+ - Oops! I shouldn't have shipped that
111
+
112
+ ## [3.1.0] - 2024-06-11
113
+
114
+ :warning: **This release includes several breaking changes.** Refer to the **Removed** section below for the list of deprecated methods that have been removed in this release.
115
+
116
+ Rack v3.1 is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
117
+
118
+ ### SPEC Changes
119
+
120
+ - `rack.input` is now optional. ([#1997](https://github.com/rack/rack/pull/1997), [#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
121
+ - `PATH_INFO` is now validated according to the HTTP/1.1 specification. ([#2117](https://github.com/rack/rack/pull/2117), [#2181](https://github.com/rack/rack/pull/2181), [@ioquatix])
122
+ - `OPTIONS *` is now accepted. ([#2114](https://github.com/rack/rack/pull/2114), [@doriantaylor](https://github.com/doriantaylor))
123
+ - Introduce optional `rack.protocol` request and response header for handling connection upgrades. ([#1954](https://github.com/rack/rack/pull/1954), [@ioquatix])
124
+
125
+ ### Added
126
+
127
+ - Introduce `Rack::Multipart::MissingInputError` for improved handling of missing input in `#parse_multipart`. ([#2018](https://github.com/rack/rack/pull/2018), [@ioquatix])
128
+ - Introduce `module Rack::BadRequest` which is included in multipart and query parser errors. ([#2019](https://github.com/rack/rack/pull/2019), [@ioquatix])
129
+ - Add `.mjs` MIME type ([#2057](https://github.com/rack/rack/pull/2057), [@axilleas](https://github.com/axilleas))
130
+ - `set_cookie_header` utility now supports the `partitioned` cookie attribute. This is required by Chrome in some embedded contexts. ([#2131](https://github.com/rack/rack/pull/2131), [@flavio-b](https://github.com/flavio-b))
131
+ - Introduce `rack.early_hints` for sending `103 Early Hints` informational responses. ([#1831](https://github.com/rack/rack/pull/1831), [@casperisfine](https://github.com/casperisfine), [@jeremyevans])
132
+
133
+ ### Changed
134
+
135
+ - MIME type for JavaScript files (`.js`) changed from `application/javascript` to `text/javascript` ([`1bd0f15`](https://github.com/rack/rack/commit/1bd0f1597d8f4a90d47115f3e156a8ce7870c9c8), [@ioquatix])
136
+ - Update MIME types associated to `.ttf`, `.woff`, `.woff2` and `.otf` extensions to use mondern `font/*` types. ([#2065](https://github.com/rack/rack/pull/2065), [@davidstosik])
137
+ - `Rack::Utils.escape_html` is now delegated to `CGI.escapeHTML`. `'` is escaped to `#39;` instead of `#x27;`. (decimal vs hexadecimal) ([#2099](https://github.com/rack/rack/pull/2099), [@JunichiIto](https://github.com/JunichiIto))
138
+ - Clarify use of `@buffered` and only update `content-length` when `Rack::Response#finish` is invoked. ([#2149](https://github.com/rack/rack/pull/2149), [@ioquatix])
139
+
140
+ ### Deprecated
141
+
142
+ - Deprecate automatic cache invalidation in `Request#{GET,POST}` ([#2073](https://github.com/rack/rack/pull/2073), [@jeremyevans])
143
+ - Only cookie keys that are not valid according to the HTTP specifications are escaped. We are planning to deprecate this behaviour, so now a deprecation message will be emitted in this case. In the future, invalid cookie keys may not be accepted. ([#2191](https://github.com/rack/rack/pull/2191), [@ioquatix])
144
+ - `Rack::Logger` is deprecated. ([#2197](https://github.com/rack/rack/pull/2197), [@ioquatix])
145
+ - Add fallback lookup and deprecation warning for obsolete status symbols. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
146
+ - Deprecate `Rack::Request#values_at`, use `request.params.values_at` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
147
+
148
+ ### Removed
149
+
150
+ - Remove deprecated `Rack::Auth::Digest` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
151
+ - Remove deprecated `Rack::Cascade::NotFound` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
152
+ - Remove deprecated `Rack::Chunked` with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
153
+ - Remove deprecated `Rack::File`, use `Rack::Files` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
154
+ - Remove deprecated `Rack::QueryParser` `key_space_limit` parameter with no replacement. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
155
+ - Remove deprecated `Rack::Response#header`, use `Rack::Response#headers` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
156
+ - Remove deprecated cookie methods from `Rack::Utils`: `add_cookie_to_header`, `make_delete_cookie_header`, `add_remove_cookie_to_header`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
157
+ - Remove deprecated `Rack::Utils::HeaderHash`. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
158
+ - Remove deprecated `Rack::VERSION`, `Rack::VERSION_STRING`, `Rack.version`, use `Rack.release` instead. ([#1966](https://github.com/rack/rack/pull/1966), [@ioquatix])
159
+ - Remove non-standard status codes 306, 509, & 510 and update descriptions for 413, 422, & 451. ([#2137](https://github.com/rack/rack/pull/2137), [@wtn](https://github.com/wtn))
160
+ - Remove any dependency on `transfer-encoding: chunked`. ([#2195](https://github.com/rack/rack/pull/2195), [@ioquatix])
161
+ - Remove deprecated `Rack::Request#[]`, use `request.params[key]` instead ([#2183](https://github.com/rack/rack/pull/2183), [@ioquatix])
162
+
163
+ ### Fixed
164
+
165
+ - In `Rack::Files`, ignore the `Range` header if served file is 0 bytes. ([#2159](https://github.com/rack/rack/pull/2159), [@zarqman])
166
+
5
167
  ## [3.0.18] - 2025-05-22
6
168
 
7
169
  - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
@@ -14,7 +176,7 @@ All notable changes to this project will be documented in this file. For info on
14
176
 
15
177
  ### Security
16
178
 
17
- - [CVE-2025-46727](https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
179
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
18
180
 
19
181
  ## [3.0.15] - 2025-04-13
20
182
 
@@ -24,13 +186,13 @@ All notable changes to this project will be documented in this file. For info on
24
186
 
25
187
  ### Security
26
188
 
27
- - [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
189
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
28
190
 
29
191
  ## [3.0.13] - 2025-03-04
30
192
 
31
193
  ### Security
32
194
 
33
- - [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
195
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
34
196
 
35
197
  ### Fixed
36
198
 
@@ -40,7 +202,7 @@ All notable changes to this project will be documented in this file. For info on
40
202
 
41
203
  ### Security
42
204
 
43
- - [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
205
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
44
206
 
45
207
  ## [3.0.11] - 2024-05-10
46
208
 
@@ -218,6 +380,31 @@ All notable changes to this project will be documented in this file. For info on
218
380
  - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
219
381
  - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
220
382
 
383
+ ## [2.2.20] - 2025-10-10
384
+
385
+ ### Security
386
+
387
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
388
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
389
+
390
+ ## [2.2.19] - 2025-10-07
391
+
392
+ ### Security
393
+
394
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
395
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
396
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
397
+
398
+ ## [2.2.18] - 2025-09-25
399
+
400
+ ### Security
401
+
402
+ - [CVE-2025-59830](https://github.com/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
403
+
404
+ ## [2.2.17] - 2025-06-03
405
+
406
+ - Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
407
+
221
408
  ## [2.2.16] - 2025-05-22
222
409
 
223
410
  - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
@@ -230,25 +417,25 @@ All notable changes to this project will be documented in this file. For info on
230
417
 
231
418
  ### Security
232
419
 
233
- - [CVE-2025-46727](https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
420
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
234
421
 
235
422
  ## [2.2.13] - 2025-03-11
236
423
 
237
424
  ### Security
238
425
 
239
- - [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
426
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
240
427
 
241
428
  ## [2.2.12] - 2025-03-04
242
429
 
243
430
  ### Security
244
431
 
245
- - [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
432
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
246
433
 
247
434
  ## [2.2.11] - 2025-02-12
248
435
 
249
436
  ### Security
250
437
 
251
- - [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
438
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
252
439
 
253
440
  ## [2.2.10] - 2024-10-14
254
441
 
@@ -303,6 +490,8 @@ All notable changes to this project will be documented in this file. For info on
303
490
 
304
491
  ## [2.2.3.1] - 2022-05-27
305
492
 
493
+ ### Security
494
+
306
495
  - [CVE-2022-30123] Fix shell escaping issue in Common Logger
307
496
  - [CVE-2022-30122] Restrict parsing of broken MIME attachments
308
497
 
@@ -1010,4 +1199,5 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
1010
1199
  [@amatsuda]: https://github.com/amatsuda "Akira Matsuda"
1011
1200
  [@wjordan]: https://github.com/wjordan "Will Jordan"
1012
1201
  [@BlakeWilliams]: https://github.com/BlakeWilliams "Blake Williams"
1202
+ [@davidstosik]: https://github.com/davidstosik "David Stosik"
1013
1203
  [@earlopain]: https://github.com/earlopain "Earlopain"
data/CONTRIBUTING.md CHANGED
@@ -5,6 +5,15 @@ contributors](https://github.com/rack/rack/graphs/contributors). You're
5
5
  encouraged to submit [pull requests](https://github.com/rack/rack/pulls) and
6
6
  [propose features and discuss issues](https://github.com/rack/rack/issues).
7
7
 
8
+ ## Backports
9
+
10
+ Only security patches are ideal for backporting to non-main release versions. If
11
+ you're not sure if your bug fix is backportable, you should open a discussion to
12
+ discuss it first.
13
+
14
+ The [Security Policy] documents which release versions will receive security
15
+ backports.
16
+
8
17
  ## Fork the Project
9
18
 
10
19
  Fork the [project on GitHub](https://github.com/rack/rack) and check out your
@@ -27,15 +36,6 @@ git pull upstream main
27
36
  git checkout -b my-feature-branch
28
37
  ```
29
38
 
30
- ## Bundle Install and Quick Test
31
-
32
- Ensure that you can build the project and run quick tests.
33
-
34
- ```
35
- bundle install --without extra
36
- bundle exec rake test
37
- ```
38
-
39
39
  ## Running All Tests
40
40
 
41
41
  Install all dependencies.
@@ -140,3 +140,5 @@ there!
140
140
 
141
141
  Please do know that we really appreciate and value your time and work. We love
142
142
  you, really.
143
+
144
+ [Security Policy]: SECURITY.md
data/README.md CHANGED
@@ -1,10 +1,5 @@
1
1
  # ![Rack](contrib/logo.webp)
2
2
 
3
- > **_NOTE:_** Rack v3.0.0 was recently released. Please check the [Upgrade
4
- > Guide](UPGRADE-GUIDE.md) for more details about migrating your existing
5
- > servers, middlewares and applications. For detailed information on specific
6
- > changes, check the [Change Log](CHANGELOG.md).
7
-
8
3
  Rack provides a minimal, modular, and adaptable interface for developing web
9
4
  applications in Ruby. By wrapping HTTP requests and responses in the simplest
10
5
  way possible, it unifies and distills the bridge between web servers, web
@@ -13,6 +8,32 @@ frameworks, and web application into a single method call.
13
8
  The exact details of this are described in the [Rack Specification], which all
14
9
  Rack applications should conform to.
15
10
 
11
+ ## Version support
12
+
13
+ | Version | Support |
14
+ |----------|------------------------------------|
15
+ | 3.0.x | Bug fixes and security patches. |
16
+ | 2.2.x | Security patches only. |
17
+ | <= 2.1.x | End of support. |
18
+
19
+ Please see the [Security Policy] for more information.
20
+
21
+ ## Rack 3.0
22
+
23
+ This is the latest version of Rack. It contains API improvements but also some
24
+ breaking changes. Please check the [Upgrade Guide](UPGRADE-GUIDE.md) for more
25
+ details about migrating servers, middlewares and applications designed for Rack 2
26
+ to Rack 3. For detailed information on specific changes, check the [Change Log](CHANGELOG.md).
27
+
28
+ ## Rack 2.2
29
+
30
+ This version of Rack is receiving security patches only, and effort should be
31
+ made to move to Rack 3.
32
+
33
+ Starting in Ruby 3.4 the `base64` dependency will no longer be a default gem,
34
+ and may cause a warning or error about `base64` being missing. To correct this,
35
+ add `base64` as a dependency to your project.
36
+
16
37
  ## Installation
17
38
 
18
39
  Add the rack gem to your application bundle, or follow the instructions provided
@@ -20,10 +41,10 @@ by a [supported web framework](#supported-web-frameworks):
20
41
 
21
42
  ```bash
22
43
  # Install it generally:
23
- $ gem install rack --pre
44
+ $ gem install rack
24
45
 
25
46
  # or, add it to your current application gemfile:
26
- $ bundle add rack --version 3.0.0
47
+ $ bundle add rack
27
48
  ```
28
49
 
29
50
  If you need features from `Rack::Session` or `bin/rackup` please add those gems separately.
@@ -57,7 +78,7 @@ Hello World
57
78
  Rack is supported by a wide range of servers, including:
58
79
 
59
80
  * [Agoo](https://github.com/ohler55/agoo)
60
- * [Falcon](https://github.com/socketry/falcon) **(Rack 3 Compatible)**
81
+ * [Falcon](https://github.com/socketry/falcon)
61
82
  * [Iodine](https://github.com/boazsegev/iodine)
62
83
  * [NGINX Unit](https://unit.nginx.org/)
63
84
  * [Phusion Passenger](https://www.phusionpassenger.com/) (which is mod_rack for
@@ -84,18 +105,15 @@ These frameworks and many others support the [Rack Specification]:
84
105
 
85
106
  * [Camping](https://github.com/camping/camping)
86
107
  * [Hanami](https://hanamirb.org/)
108
+ * [Ramaze](https://github.com/ramaze/ramaze)
87
109
  * [Padrino](https://padrinorb.com/)
88
- * [Roda](https://github.com/jeremyevans/roda) **(Rack 3 Compatible)**
110
+ * [Roda](https://github.com/jeremyevans/roda)
89
111
  * [Ruby on Rails](https://rubyonrails.org/)
112
+ * [Rum](https://github.com/leahneukirchen/rum)
90
113
  * [Sinatra](https://sinatrarb.com/)
91
- * [Utopia](https://github.com/socketry/utopia) **(Rack 3 Compatible)**
114
+ * [Utopia](https://github.com/socketry/utopia)
92
115
  * [WABuR](https://github.com/ohler55/wabur)
93
116
 
94
- ### Older (possibly unsupported) web frameworks
95
-
96
- * [Ramaze](http://ramaze.net/)
97
- * [Rum](https://github.com/leahneukirchen/rum)
98
-
99
117
  ## Available middleware shipped with Rack
100
118
 
101
119
  Between the server and the framework, Rack can be customized to your
@@ -192,6 +210,14 @@ query string, before attempting parsing, so if the same parameter key is
192
210
  used multiple times in the query, each counts as a separate parameter for
193
211
  this check.
194
212
 
213
+ ### `RACK_MULTIPART_BUFFERED_UPLOAD_BYTESIZE_LIMIT`
214
+
215
+ This environment variable sets the maximum amount of memory Rack will use
216
+ to buffer multipart parameters when parsing a request body. This considers
217
+ the size of the multipart mime headers and the body part for multipart
218
+ parameters that are buffered in memory and do not use tempfiles. This
219
+ defaults to 16MB if not provided.
220
+
195
221
  ### `param_depth_limit`
196
222
 
197
223
  ```ruby
@@ -334,3 +360,4 @@ would like to thank:
334
360
  Rack is released under the [MIT License](MIT-LICENSE).
335
361
 
336
362
  [Rack Specification]: SPEC.rdoc
363
+ [Security Policy]: SECURITY.md
data/SPEC.rdoc CHANGED
@@ -82,6 +82,10 @@ Rack-specific variables:
82
82
  <tt>rack.hijack</tt>:: See below, if present, an object responding
83
83
  to +call+ that is used to perform a full
84
84
  hijack.
85
+ <tt>rack.protocol</tt>:: An optional +Array+ of +String+, containing
86
+ the protocols advertised by the client in
87
+ the +upgrade+ header (HTTP/1) or the
88
+ +:protocol+ pseudo-header (HTTP/2).
85
89
  Additional environment specifications have approved to
86
90
  standardized middleware APIs. None of these are required to
87
91
  be implemented by the server.
@@ -112,7 +116,6 @@ The <tt>SERVER_PORT</tt> must be an Integer if set.
112
116
  The <tt>SERVER_NAME</tt> must be a valid authority as defined by RFC7540.
113
117
  The <tt>HTTP_HOST</tt> must be a valid authority as defined by RFC7540.
114
118
  The <tt>SERVER_PROTOCOL</tt> must match the regexp <tt>HTTP/\d(\.\d)?</tt>.
115
- If the <tt>HTTP_VERSION</tt> is present, it must equal the <tt>SERVER_PROTOCOL</tt>.
116
119
  The environment must not contain the keys
117
120
  <tt>HTTP_CONTENT_TYPE</tt> or <tt>HTTP_CONTENT_LENGTH</tt>
118
121
  (use the versions without <tt>HTTP_</tt>).
@@ -121,12 +124,17 @@ If the string values for CGI keys contain non-ASCII characters,
121
124
  they should use ASCII-8BIT encoding.
122
125
  There are the following restrictions:
123
126
  * <tt>rack.url_scheme</tt> must either be +http+ or +https+.
124
- * There must be a valid input stream in <tt>rack.input</tt>.
127
+ * There may be a valid input stream in <tt>rack.input</tt>.
125
128
  * There must be a valid error stream in <tt>rack.errors</tt>.
126
129
  * There may be a valid hijack callback in <tt>rack.hijack</tt>
130
+ * There may be a valid early hints callback in <tt>rack.early_hints</tt>
127
131
  * The <tt>REQUEST_METHOD</tt> must be a valid token.
128
132
  * The <tt>SCRIPT_NAME</tt>, if non-empty, must start with <tt>/</tt>
129
- * The <tt>PATH_INFO</tt>, if non-empty, must start with <tt>/</tt>
133
+ * The <tt>PATH_INFO</tt>, if provided, must be a valid request target or an empty string.
134
+ * Only <tt>OPTIONS</tt> requests may have <tt>PATH_INFO</tt> set to <tt>*</tt> (asterisk-form).
135
+ * Only <tt>CONNECT</tt> requests may have <tt>PATH_INFO</tt> set to an authority (authority-form). Note that in HTTP/2+, the authority-form is not a valid request target.
136
+ * <tt>CONNECT</tt> and <tt>OPTIONS</tt> requests must not have <tt>PATH_INFO</tt> set to a URI (absolute-form).
137
+ * Otherwise, <tt>PATH_INFO</tt> must start with a <tt>/</tt> and must not include a fragment part starting with '#' (origin-form).
130
138
  * The <tt>CONTENT_LENGTH</tt>, if given, must consist of digits only.
131
139
  * One of <tt>SCRIPT_NAME</tt> or <tt>PATH_INFO</tt> must be
132
140
  set. <tt>PATH_INFO</tt> should be <tt>/</tt> if
@@ -144,11 +152,11 @@ exceptions. They should be invoked in reverse order of registration.
144
152
  The input stream is an IO-like object which contains the raw HTTP
145
153
  POST data.
146
154
  When applicable, its external encoding must be "ASCII-8BIT" and it
147
- must be opened in binary mode, for Ruby 1.9 compatibility.
155
+ must be opened in binary mode.
148
156
  The input stream must respond to +gets+, +each+, and +read+.
149
157
  * +gets+ must be called without arguments and return a string,
150
158
  or +nil+ on EOF.
151
- * +read+ behaves like IO#read.
159
+ * +read+ behaves like <tt>IO#read</tt>.
152
160
  Its signature is <tt>read([length, [buffer]])</tt>.
153
161
 
154
162
  If given, +length+ must be a non-negative Integer (>= 0) or +nil+,
@@ -166,8 +174,8 @@ The input stream must respond to +gets+, +each+, and +read+.
166
174
  If +buffer+ is given, then the read data will be placed
167
175
  into +buffer+ instead of a newly created String object.
168
176
  * +each+ must be called without arguments and only yield Strings.
169
- * +close+ can be called on the input stream to indicate that the
170
- any remaining input is not needed.
177
+ * +close+ can be called on the input stream to indicate that
178
+ any remaining input is not needed.
171
179
 
172
180
  === The Error Stream
173
181
 
@@ -228,6 +236,16 @@ instance is recommended.
228
236
 
229
237
  The special response header +rack.hijack+ must only be set
230
238
  if the request +env+ has a truthy +rack.hijack?+.
239
+
240
+ === Early Hints
241
+
242
+ The application or any middleware may call the <tt>rack.early_hints</tt>
243
+ with an object which would be valid as the headers of a Rack response.
244
+
245
+ If <tt>rack.early_hints</tt> is present, it must respond to #call.
246
+ If <tt>rack.early_hints</tt> is called, it must be called with
247
+ valid Rack response headers.
248
+
231
249
  == The Response
232
250
 
233
251
  === The Status
@@ -249,16 +267,26 @@ Header values must be either a String instance,
249
267
  or an Array of String instances,
250
268
  such that each String instance must not contain characters below 037.
251
269
 
252
- === The content-type
270
+ ==== The +content-type+ Header
253
271
 
254
272
  There must not be a <tt>content-type</tt> header key when the +Status+ is 1xx,
255
273
  204, or 304.
256
274
 
257
- === The content-length
275
+ ==== The +content-length+ Header
258
276
 
259
277
  There must not be a <tt>content-length</tt> header key when the
260
278
  +Status+ is 1xx, 204, or 304.
261
279
 
280
+ ==== The +rack.protocol+ Header
281
+
282
+ If the +rack.protocol+ header is present, it must be a +String+, and
283
+ must be one of the values from the +rack.protocol+ array from the
284
+ environment.
285
+
286
+ Setting this value informs the server that it should perform a
287
+ connection upgrade. In HTTP/1, this is done using the +upgrade+
288
+ header. In HTTP/2, this is done by accepting the request.
289
+
262
290
  === The Body
263
291
 
264
292
  The Body is typically an +Array+ of +String+ instances, an enumerable
@@ -301,12 +329,9 @@ the body.
301
329
 
302
330
  The Enumerable Body must respond to +each+.
303
331
  It must only be called once.
304
- It must not be called after being closed.
332
+ It must not be called after being closed,
305
333
  and must only yield String values.
306
334
 
307
- The Body itself should not be an instance of String, as this will
308
- break in Ruby 1.9.
309
-
310
335
  Middleware must not call +each+ directly on the Body.
311
336
  Instead, middleware can return a new Body that calls +each+ on the
312
337
  original Body, yielding at least once per iteration.
data/lib/rack/auth/basic.rb CHANGED
@@ -2,7 +2,6 @@
2
2
 
3
3
  require_relative 'abstract/handler'
4
4
  require_relative 'abstract/request'
5
- require 'base64'
6
5
 
7
6
  module Rack
8
7
  module Auth
@@ -46,7 +45,7 @@ module Rack
46
45
  end
47
46
 
48
47
  def credentials
49
- @credentials ||= Base64.decode64(params).split(':', 2)
48
+ @credentials ||= params.unpack1('m').split(':', 2)
50
49
  end
51
50
 
52
51
  def username
data/lib/rack/bad_request.rb ADDED
@@ -0,0 +1,8 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Rack
4
+ # Represents a 400 Bad Request error when input data fails to meet the
5
+ # requirements.
6
+ module BadRequest
7
+ end
8
+ end