rack 3.1.22 → 3.1.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3f9b36f03c948233dee682ef0a4724302be7f64dee1b599d45c7ef4068c6b0c
-  data.tar.gz: 428c57448bdc479dd1bab423ff9df7376e660a9603b648de733c7c08ae186693
+  metadata.gz: 0eea0a8704e9041b0816ff683feadf99a2f94106884de54455550b427f437981
+  data.tar.gz: 72e7f3f74af13b783cb4ad583301092c0ccb19b8245a72fe9c1ed38351c8067f
 SHA512:
-  metadata.gz: f25b66f8c806f983f6ec504f5c97ffeec03d1994d8ba508763fb903923c28a9d6a85feab7bba9f6da248e90ef6697dabda9da32ea62d3935259ea4e963ad79d2
-  data.tar.gz: 2cc6a87b8003ed98a246913322e266e83e7c3cd1247e27e2540dbed28910cfef76c34dbd635f26da547817f2136d87468be6b3c98566c627fbf9b854f51cce62
+  metadata.gz: fd22ed0b602803fce4cc4a4b00e3e055f5dafc7b9ef8925d4c2d9fb7eed1c5ee27eec1a06001b08dd560e62074dd9a6f7dffcc70b1229eebae81648be8914f9f
+  data.tar.gz: 4563c28eaa11ff0a607c8f1d31a8b9483fd1d9b0b9ca55d684bea8bf52e50d72519ec062d130921108b115537e6738792645307718f20c7ec8b9a8e563166811

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.1.23] - 2026-10-30
+
+### Security
+
+- [GHSA-5v64-555j-wjxm](https://github.com/advisories/GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
+- [GHSA-wvg4-6p58-3gh3](https://github.com/advisories/GHSA-wvg4-6p58-3gh3) `Rack::Static` header rules were matched against an unnormalized path, allowing dot segments to bypass them.
+- [GHSA-2j8w-xcrc-x985](https://github.com/advisories/GHSA-2j8w-xcrc-x985) `Rack::Request#host_with_port`, `#base_url`, and `#url` returned the raw authority when it was invalid; `host_with_port` now returns `nil` in that case.
+- [GHSA-p8x9-v4hv-2w4g](https://github.com/advisories/GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one `boundary` parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
+
 ## [3.1.22] - 2026-08-13
 
 ### Security

data/lib/rack/multipart/parser.rb

@@ -115,7 +115,11 @@ module Rack
         unless data[1].empty?
           raise Error, "whitespace between boundary parameter name and equal sign"
         end
-        if data.post_match.match?(/boundary\s*=/i)
+        # Count across the whole header rather than only after the match: the
+        # lazy prefix in MULTIPART can skip a first boundary parameter whose
+        # value is empty or starts with a quote, semicolon, or comma. Also
+        # count RFC 2231 boundary* parameters, which some parsers prefer.
+        if content_type.scan(/boundary(?:\*\d*\*?)?\s*=/i).size > 1
           raise BoundaryTooLongError, "multiple boundary parameters found in multipart content type"
         end
 
@@ -485,6 +489,7 @@ module Rack
           # buffering. Note that the actual limit is the higher of 64KB and the buffer size (1MB by default)
           raise Error, "multipart mime part header too large" if @sbuf.rest.bytesize > MIME_HEADER_BYTESIZE_LIMIT
 
+          @sbuf.string = @sbuf.rest
           return :want_read
         end
       end
@@ -505,8 +510,8 @@ module Rack
             update_retained_size(body.bytesize) if @body_retained
             @collector.on_mime_body @mime_index, body
             @sbuf.pos += delta
-            @sbuf.string = @sbuf.rest
           end
+          @sbuf.string = @sbuf.rest
           :want_read
         end
       end

data/lib/rack/request.rb

@@ -320,8 +320,10 @@ module Rack
       end
 
       def host_with_port(authority = self.authority)
-        host, _, port = split_authority(authority)
+        parts = split_authority(authority)
+        return nil if parts.empty?
 
+        host, _, port = parts
         if port == DEFAULT_PORTS[self.scheme]
           host
         else
@@ -591,7 +593,8 @@ module Rack
       end
 
       def base_url
-        "#{scheme}://#{host_with_port}"
+        hostport = host_with_port || host_with_port(server_authority)
+        "#{scheme}://#{hostport}"
       end
 
       # Tries to return a remake of the original request URL as a string.

data/lib/rack/static.rb

@@ -168,7 +168,7 @@ module Rack
 
     # Convert HTTP header rules to HTTP headers
     def applicable_rules(path)
-      path = ::Rack::Utils.unescape_path(path)
+      path = ::Rack::Utils.clean_path_info(::Rack::Utils.unescape_path(path))
 
       @header_rules.find_all do |rule, new_headers|
         case rule

data/lib/rack/version.rb

@@ -12,7 +12,7 @@
 # so it should be enough just to <tt>require 'rack'</tt> in your code.
 
 module Rack
-  RELEASE = "3.1.22"
+  RELEASE = "3.1.23"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 3.1.22
+  version: 3.1.23
 platform: ruby
 authors:
 - Leah Neukirchen