rack 3.0.6 → 3.0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of rack might be problematic. Click here for more details.

Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +4 -0
  3. data/lib/rack/request.rb +2 -2
  4. data/lib/rack/version.rb +1 -1
  5. metadata +5 -5
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2917b0c6ec8772cd25183ae4023a21bf3e9114f20878986597f2f869855a0022
4
- data.tar.gz: a75b0cab6913b118a672c9f7eeae02454f557ce2b7032ffb68f8cdd80bf0f326
3
+ metadata.gz: b43a4c41d97b3e6b9790b04c0713ac20814fa986310ccd17918baaaf3f94b260
4
+ data.tar.gz: a461e437f8cf4591d39d4a84fdceec6ffddb3d11c67fc5a4bdf74926e18d80bc
5
5
  SHA512:
6
- metadata.gz: 5fa7418e0a9f9af9c17fb64fee506eba9e7082d2c2f27df03f4aa3614278ca5b5a9af8ab9b1c630e55f5cccffbd39ba8b13775e5cdc9e5c77fb76922ae6a92d6
7
- data.tar.gz: 18d783dea490e15e3181c2c458e729b88b476d3166db34cd379bc0e93bce066f6f42c84180808f639eddd9a8544d56d20adb9360a440a932c8dc9e016853dd24
6
+ metadata.gz: cb7fcf3c2fa1cd168ff0373246160eec7fa6d94a6b4e5d88438f2239cf79e8b9df708626b32603f63368c1133ca7b3fb00d16a292ca5214a7740c558201c1a0f
7
+ data.tar.gz: 64d3a5fb0603f6f12760bd2ff95a118985eb843b1875d36c9f9f2af37ca413f311e3c566f5861efb159349d9958ef2c78f8d537ba618009d0ca3ac91047d6d53
data/CHANGELOG.md CHANGED
@@ -2,6 +2,10 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## [3.0.6.1] - 2023-03-13
6
+
7
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
8
+
5
9
  ## [3.0.4.1] - 2023-03-02
6
10
 
7
11
  - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
data/lib/rack/request.rb CHANGED
@@ -666,8 +666,8 @@ module Rack
666
666
  end
667
667
 
668
668
  def parse_http_accept_header(header)
669
- header.to_s.split(/\s*,\s*/).map do |part|
670
- attribute, parameters = part.split(/\s*;\s*/, 2)
669
+ header.to_s.split(",").each(&:strip!).map do |part|
670
+ attribute, parameters = part.split(";", 2).each(&:strip!)
671
671
  quality = 1.0
672
672
  if parameters and /\Aq=([\d.]+)/ =~ parameters
673
673
  quality = $1.to_f
data/lib/rack/version.rb CHANGED
@@ -25,7 +25,7 @@ module Rack
25
25
  VERSION
26
26
  end
27
27
 
28
- RELEASE = "3.0.6"
28
+ RELEASE = "3.0.6.1"
29
29
 
30
30
  # Return the Rack release as a dotted string.
31
31
  def self.release
metadata CHANGED
@@ -1,11 +1,11 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rack
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.0.6
4
+ version: 3.0.6.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Leah Neukirchen
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
11
  date: 2023-03-13 00:00:00.000000000 Z
@@ -149,7 +149,7 @@ metadata:
149
149
  changelog_uri: https://github.com/rack/rack/blob/main/CHANGELOG.md
150
150
  documentation_uri: https://rubydoc.info/github/rack/rack
151
151
  source_code_uri: https://github.com/rack/rack
152
- post_install_message:
152
+ post_install_message:
153
153
  rdoc_options: []
154
154
  require_paths:
155
155
  - lib
@@ -164,8 +164,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
164
164
  - !ruby/object:Gem::Version
165
165
  version: '0'
166
166
  requirements: []
167
- rubygems_version: 3.4.6
168
- signing_key:
167
+ rubygems_version: 3.0.3.1
168
+ signing_key:
169
169
  specification_version: 4
170
170
  summary: A modular Ruby webserver interface.
171
171
  test_files: []