rack 3.1.21 → 3.1.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7aaf1007eae50de14eec6eaa6a4d586f1fe15b614bfe77bf68bea65c6ad59423
-  data.tar.gz: 56ce4db8b9c1aeffaf750836ea16bf264841909aeb4befb81719e45189742ac3
+  metadata.gz: 0eea0a8704e9041b0816ff683feadf99a2f94106884de54455550b427f437981
+  data.tar.gz: 72e7f3f74af13b783cb4ad583301092c0ccb19b8245a72fe9c1ed38351c8067f
 SHA512:
-  metadata.gz: 3917f67c856cf670e2f3eaf4432b74366f8b5ee09a78ae2acad9075b10cca355fc718b5025fed92091b56187e4e614fc5ab24066c26298a3af4352ec064fe490
-  data.tar.gz: 6a741930a02797a64a50bf7fb8e11957e4bf0c5771a26e0491c131c3ad71d0e120f5a70ceec80fe12c0d866daaa822eb0cdcb9f55a9a2d509ef01659fde08231
+  metadata.gz: fd22ed0b602803fce4cc4a4b00e3e055f5dafc7b9ef8925d4c2d9fb7eed1c5ee27eec1a06001b08dd560e62074dd9a6f7dffcc70b1229eebae81648be8914f9f
+  data.tar.gz: 4563c28eaa11ff0a607c8f1d31a8b9483fd1d9b0b9ca55d684bea8bf52e50d72519ec062d130921108b115537e6738792645307718f20c7ec8b9a8e563166811

data/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.1.23] - 2026-10-30
+
+### Security
+
+- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
+- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them.
+- [GHSA-2j8w-xcrc-x985](https://github.com/advisories/GHSA-2j8w-xcrc-x985) `Rack::Request#host_with_port`, `#base_url`, and `#url` returned the raw authority when it was invalid; `host_with_port` now returns `nil` in that case.
+- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
+
+## [3.1.22] - 2026-08-13
+
+### Security
+
+- [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
+
+### Fixed
+
+- Restore Ruby 2.4/2.5 compatibility.
+
 ## [3.1.21] - 2026-04-01
 
 ### Security
@@ -17,7 +36,7 @@ All notable changes to this project will be documented in this file. For info on
 - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
 - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
 - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
-- [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Quadratic-time multipart header parsing allows denial of service via escape-heavy quoted parameters.
+- [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
 
 ## [3.1.20] - 2026-02-16
 
@@ -410,6 +429,26 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
 - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
 - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
 
+## [2.2.24] - 2026-08-13
+
+### Security
+
+- [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
+
+## [2.2.23] - 2026-04-01
+
+### Security
+
+- [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
+- [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
+- [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
+- [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
+- [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
+- [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
+- [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
+- [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
+- [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
+
 ## [2.2.22] - 2026-02-16
 
 ### Security

data/lib/rack/multipart/parser.rb

@@ -115,7 +115,11 @@ module Rack
         unless data[1].empty?
           raise Error, "whitespace between boundary parameter name and equal sign"
         end
-        if data.post_match.match?(/boundary\s*=/i)
+        # Count across the whole header rather than only after the match: the
+        # lazy prefix in MULTIPART can skip a first boundary parameter whose
+        # value is empty or starts with a quote, semicolon, or comma. Also
+        # count RFC 2231 boundary* parameters, which some parsers prefer.
+        if content_type.scan(/boundary(?:\*\d*\*?)?\s*=/i).size > 1
           raise BoundaryTooLongError, "multiple boundary parameters found in multipart content type"
         end
 
@@ -360,13 +364,19 @@ module Rack
 
       CONTENT_DISPOSITION_MAX_PARAMS = 16
       CONTENT_DISPOSITION_MAX_BYTES = 1536
+      OBS_UNFOLD = /\r\n([ \t])/
+      private_constant :OBS_UNFOLD
       def handle_mime_head
         if @sbuf.scan_until(@head_regex)
           head = @sbuf[1]
           content_type = head[MULTIPART_CONTENT_TYPE, 1]
+          content_type.gsub!(OBS_UNFOLD, '\\1') if content_type
           if (disposition = head[MULTIPART_CONTENT_DISPOSITION, 1]) &&
               disposition.bytesize <= CONTENT_DISPOSITION_MAX_BYTES
 
+            # Implement OBS unfolding (RFC 5322 Section 2.2.3)
+            disposition.gsub!(OBS_UNFOLD, '\\1')
+
             # ignore actual content-disposition value (should always be form-data)
             i = disposition.index(';')
             disposition.slice!(0, i+1)
@@ -479,6 +489,7 @@ module Rack
           # buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default)
           raise Error, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT
 
+          @sbuf.string = @sbuf.rest
           return :want_read
         end
       end
@@ -499,8 +510,8 @@ module Rack
             update_retained_size(body.bytesize) if @body_retained
             @collector.on_mime_body @mime_index, body
             @sbuf.pos += delta
-            @sbuf.string = @sbuf.rest
           end
+          @sbuf.string = @sbuf.rest
           :want_read
         end
       end

data/lib/rack/request.rb

@@ -320,8 +320,10 @@ module Rack
       end
 
       def host_with_port(authority = self.authority)
-        host, _, port = split_authority(authority)
+        parts = split_authority(authority)
+        return nil if parts.empty?
 
+        host, _, port = parts
         if port == DEFAULT_PORTS[self.scheme]
           host
         else
@@ -591,7 +593,8 @@ module Rack
       end
 
       def base_url
-        "#{scheme}://#{host_with_port}"
+        hostport = host_with_port || host_with_port(server_authority)
+        "#{scheme}://#{hostport}"
       end
 
       # Tries to return a remake of the original request URL as a string.

data/lib/rack/static.rb

@@ -168,7 +168,7 @@ module Rack
 
     # Convert HTTP header rules to HTTP headers
     def applicable_rules(path)
-      path = ::Rack::Utils.unescape_path(path)
+      path = ::Rack::Utils.clean_path_info(::Rack::Utils.unescape_path(path))
 
       @header_rules.find_all do |rule, new_headers|
         case rule

data/lib/rack/utils.rb

@@ -146,8 +146,8 @@ module Rack
       end
     end
 
-    ALLOWED_FORWARED_PARAMS = %w[by for host proto].to_h { |name| [name, name.to_sym] }.freeze
-    private_constant :ALLOWED_FORWARED_PARAMS
+    ALLOWED_FORWARDED_PARAMS = %w[by for host proto].map { |name| [name, name.to_sym] }.to_h.freeze
+    private_constant :ALLOWED_FORWARDED_PARAMS
 
     def forwarded_values(forwarded_header)
       return unless forwarded_header
@@ -170,7 +170,7 @@ module Rack
         param.chomp!('=')
         param.strip!
         param.downcase!
-        return unless param = ALLOWED_FORWARED_PARAMS[param]
+        return unless param = ALLOWED_FORWARDED_PARAMS[param]
 
         if header[0] == '"'
           # Parameter value is quoted, parse it, handling backslash escapes

data/lib/rack/version.rb

@@ -12,7 +12,7 @@
 # so it should be enough just to <tt>require 'rack'</tt> in your code.
 
 module Rack
-  RELEASE = "3.1.21"
+  RELEASE = "3.1.23"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 3.1.21
+  version: 3.1.23
 platform: ruby
 authors:
 - Leah Neukirchen
@@ -156,7 +156,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []