rack 3.1.22 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of rack might be problematic. Click here for more details.

Files changed (28) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +58 -108
  3. data/README.md +41 -28
  4. data/SPEC.rdoc +199 -306
  5. data/lib/rack/auth/abstract/request.rb +2 -0
  6. data/lib/rack/builder.rb +6 -0
  7. data/lib/rack/conditional_get.rb +4 -3
  8. data/lib/rack/constants.rb +1 -0
  9. data/lib/rack/directory.rb +3 -6
  10. data/lib/rack/files.rb +1 -1
  11. data/lib/rack/head.rb +2 -3
  12. data/lib/rack/lint.rb +430 -457
  13. data/lib/rack/media_type.rb +6 -7
  14. data/lib/rack/mock_response.rb +19 -25
  15. data/lib/rack/multipart/parser.rb +37 -100
  16. data/lib/rack/multipart/uploaded_file.rb +42 -5
  17. data/lib/rack/query_parser.rb +41 -26
  18. data/lib/rack/request.rb +48 -60
  19. data/lib/rack/rewindable_input.rb +4 -1
  20. data/lib/rack/sendfile.rb +21 -51
  21. data/lib/rack/show_exceptions.rb +4 -2
  22. data/lib/rack/show_status.rb +0 -2
  23. data/lib/rack/static.rb +3 -7
  24. data/lib/rack/utils.rb +28 -129
  25. data/lib/rack/version.rb +4 -8
  26. data/lib/rack.rb +0 -1
  27. metadata +3 -3
  28. data/lib/rack/logger.rb +0 -23
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: f3f9b36f03c948233dee682ef0a4724302be7f64dee1b599d45c7ef4068c6b0c
4
- data.tar.gz: 428c57448bdc479dd1bab423ff9df7376e660a9603b648de733c7c08ae186693
3
+ metadata.gz: 17b6834d4c6a07c5cf23757814f450f39e32589ef0a6300310c7ab111a8c99c2
4
+ data.tar.gz: db3d1475837e3d45082994af134b5ceb9e0b83f400244c33262c343f421798f0
5
5
  SHA512:
6
- metadata.gz: f25b66f8c806f983f6ec504f5c97ffeec03d1994d8ba508763fb903923c28a9d6a85feab7bba9f6da248e90ef6697dabda9da32ea62d3935259ea4e963ad79d2
7
- data.tar.gz: 2cc6a87b8003ed98a246913322e266e83e7c3cd1247e27e2540dbed28910cfef76c34dbd635f26da547817f2136d87468be6b3c98566c627fbf9b854f51cce62
6
+ metadata.gz: 36b2bb65194e71b496e946090552bc97f3367426d4c169b0da384ee284068dd809d9d89fc585a49caa313a48e73eea3ce4f1dd47f2a5f103da9ac006f9f6d12a
7
+ data.tar.gz: 934940c91b89ebcf4a3015d3876e850f470d97ac82e189a390ff07efed1664d153a28546f8576fa99d6e6361f168ab1c6ffd8541509ddfe709436bd649cca29d
data/CHANGELOG.md CHANGED
@@ -2,60 +2,54 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
- ## [3.1.22] - 2026-08-13
5
+ ## Unreleased
6
6
 
7
- ### Security
8
-
9
- - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
10
-
11
- ### Fixed
7
+ ## [3.2.0] - 2025-07-31
12
8
 
13
- - Restore Ruby 2.4/2.5 compatibility.
9
+ This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.
14
10
 
15
- ## [3.1.21] - 2026-04-01
16
-
17
- ### Security
11
+ ### SPEC Changes
18
12
 
19
- - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
20
- - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
21
- - [CVE-2026-32762](https://github.com/advisories/GHSA-qfgr-crr9-7r49) Forwarded header semicolon injection enables Host and Scheme spoofing.
22
- - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
23
- - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
24
- - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
25
- - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
26
- - [CVE-2026-34835](https://github.com/advisories/GHSA-g2pf-xv49-m2h5) `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
27
- - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
28
- - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
29
- - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
30
- - [CVE-2026-34827](https://github.com/advisories/GHSA-v6x5-cg8r-vv6x) Multipart header parsing allows denial of service via escape-heavy quoted parameters.
31
-
32
- ## [3.1.20] - 2026-02-16
13
+ - Request environment keys must now be strings. ([#2310](https://github.com/rack/rack/issues/2310), [@jeremyevans])
14
+ - Add `nil` as a valid return from a Response `body.to_path` ([#2318](https://github.com/rack/rack/pull/2318), [@MSP-Greg])
15
+ - `Rack::Lint#check_header_value` is relaxed, only disallowing CR/LF/NUL characters. ([#2354](https://github.com/rack/rack/pull/2354), [@ioquatix])
33
16
 
34
- ### Security
17
+ ### Added
35
18
 
36
- - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
37
- - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
19
+ - Introduce `Rack::VERSION` constant. ([#2199](https://github.com/rack/rack/pull/2199), [@ioquatix])
20
+ - `ISO-2022-JP` encoded parts within MIME Multipart sections of an HTTP request body will now be converted to `UTF-8`. ([#2245](https://github.com/rack/rack/pull/2245), [@nappa](https://github.com/nappa))
21
+ - Add `Rack::Request#query_parser=` to allow setting the query parser to use. ([#2349](https://github.com/rack/rack/pull/2349), [@jeremyevans])
22
+ - Add `Rack::Request#form_pairs` to access form data as raw key-value pairs, preserving duplicate keys. ([#2351](https://github.com/rack/rack/pull/2351), [@matthewd])
38
23
 
39
- ## [3.1.19] - 2025-11-03
24
+ ### Changed
40
25
 
41
- ### Fixed
26
+ - Invalid cookie keys will now raise an error. ([#2193](https://github.com/rack/rack/pull/2193), [@ioquatix])
27
+ - `Rack::MediaType#params` now handles empty strings. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
28
+ - Avoid unnecessary calls to the `ip_filter` lambda to evaluate `Request#ip` ([#2287](https://github.com/rack/rack/pull/2287), [@willbryant])
29
+ - Only calculate `Request#ip` once per request ([#2292](https://github.com/rack/rack/pull/2292), [@willbryant])
30
+ - `Rack::Builder` `#use`, `#map`, and `#run` methods now return `nil`. ([#2355](https://github.com/rack/rack/pull/2355), [@ioquatix])
31
+ - Directly close the body in `Rack::ConditionalGet` when the response is `304 Not Modified`. ([#2353](https://github.com/rack/rack/pull/2353), [@ioquatix])
32
+ - Directly close the body in `Rack::Head` when the request method is `HEAD`([#2360](https://github.com/rack/rack/pull/2360), [@skipkayhil](https://github.com/skipkayhil))
42
33
 
43
- - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
34
+ ### Deprecated
44
35
 
45
- ## [3.1.18] - 2025-10-10
36
+ - `Rack::Auth::AbstractRequest#request` is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
37
+ - `Rack::Request#parse_multipart` (private method designed to be overridden in subclasses) is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
46
38
 
47
- ### Security
48
-
49
- - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
50
- - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
39
+ ### Removed
51
40
 
52
- ## [3.1.17] - 2025-10-07
41
+ - `Rack::Request#values_at` is removed. ([#2200](https://github.com/rack/rack/pull/2200), [@ioquatix])
42
+ - `Rack::Logger` is removed with no replacement. ([#2196](https://github.com/rack/rack/pull/2196), [@ioquatix])
43
+ - Automatic cache invalidation in `Rack::Request#{GET,POST}` has been removed. ([#2230](https://github.com/rack/rack/pull/2230), [@jeremyevans])
44
+ - Support for `CGI::Cookie` has been removed. ([#2332](https://github.com/rack/rack/pull/2332), [@ioquatix])
53
45
 
54
- ### Security
46
+ ### Fixed
55
47
 
56
- - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
57
- - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
58
- - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
48
+ - `Rack::RewindableInput::Middleware` no longer wraps a nil input. ([#2259](https://github.com/rack/rack/pull/2259), [@tt](https://github.com/tt))
49
+ - Fix `NoMethodError` in `Rack::Request#wrap_ipv6` when `x-forwarded-host` is empty. ([#2270](https://github.com/rack/rack/pull/2270), [@oieioi](https://github.com/oieioi))
50
+ - Fix the specification for `SERVER_PORT` which was incorrectly documented as required to be an `Integer` if present - it must be a `String` containing digits only. ([#2296](https://github.com/rack/rack/pull/2296), [@ioquatix])
51
+ - `SERVER_NAME` and `HTTP_HOST` are now more strictly validated according to the relevant specifications. ([#2298](https://github.com/rack/rack/pull/2298), [@ioquatix])
52
+ - `Rack::Lint` now disallows `PATH_INFO="" SCRIPT_NAME=""`. ([#2298](https://github.com/rack/rack/issues/2307), [@jeremyevans])
59
53
 
60
54
  ## [3.1.16] - 2025-06-04
61
55
 
@@ -69,9 +63,11 @@ All notable changes to this project will be documented in this file. For info on
69
63
 
70
64
  ## [3.1.14] - 2025-05-06
71
65
 
66
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
67
+
72
68
  ### Security
73
69
 
74
- - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
70
+ - [CVE-2025-46727](https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
75
71
 
76
72
  ## [3.1.13] - 2025-04-13
77
73
 
@@ -81,19 +77,19 @@ All notable changes to this project will be documented in this file. For info on
81
77
 
82
78
  ### Security
83
79
 
84
- - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
80
+ - [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
85
81
 
86
82
  ## [3.1.11] - 2025-03-04
87
83
 
88
84
  ### Security
89
85
 
90
- - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
86
+ - [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
91
87
 
92
88
  ## [3.1.10] - 2025-02-12
93
89
 
94
90
  ### Security
95
91
 
96
- - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
92
+ - [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
97
93
 
98
94
  ## [3.1.9] - 2025-01-31
99
95
 
@@ -126,7 +122,7 @@ All notable changes to this project will be documented in this file. For info on
126
122
 
127
123
  ### Security
128
124
 
129
- - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
125
+ - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
130
126
 
131
127
  ## [3.1.4] - 2024-06-22
132
128
 
@@ -153,7 +149,7 @@ All notable changes to this project will be documented in this file. For info on
153
149
 
154
150
  :warning: **This release includes several breaking changes.** Refer to the **Removed** section below for the list of deprecated methods that have been removed in this release.
155
151
 
156
- Rack v3.1 is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
152
+ This release is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
157
153
 
158
154
  ### SPEC Changes
159
155
 
@@ -214,9 +210,11 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
214
210
 
215
211
  ## [3.0.16] - 2025-05-06
216
212
 
213
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
214
+
217
215
  ### Security
218
216
 
219
- - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
217
+ - [CVE-2025-46727](https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
220
218
 
221
219
  ## [3.0.15] - 2025-04-13
222
220
 
@@ -226,13 +224,13 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
226
224
 
227
225
  ### Security
228
226
 
229
- - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
227
+ - [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
230
228
 
231
229
  ## [3.0.13] - 2025-03-04
232
230
 
233
231
  ### Security
234
232
 
235
- - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
233
+ - [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
236
234
 
237
235
  ### Fixed
238
236
 
@@ -242,7 +240,7 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
242
240
 
243
241
  ### Security
244
242
 
245
- - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
243
+ - [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
246
244
 
247
245
  ## [3.0.11] - 2024-05-10
248
246
 
@@ -332,6 +330,8 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
332
330
 
333
331
  ## [3.0.0] - 2022-09-06
334
332
 
333
+ This release introduces major improvements to Rack, including enhanced support for streaming responses, expanded protocol handling, and stricter compliance with HTTP standards. It refines middleware interfaces, improves multipart and hijack handling, and strengthens security and error reporting. The update also brings performance optimizations, better compatibility with modern Ruby versions, and numerous bug fixes, making Rack more robust and flexible for web application development.
334
+
335
335
  - No changes
336
336
 
337
337
  ## [3.0.0.rc1] - 2022-09-04
@@ -420,60 +420,6 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
420
420
  - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
421
421
  - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
422
422
 
423
- ## [2.2.24] - 2026-08-13
424
-
425
- ### Security
426
-
427
- - [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
428
-
429
- ## [2.2.23] - 2026-04-01
430
-
431
- ### Security
432
-
433
- - [CVE-2026-34763](https://github.com/advisories/GHSA-7mqq-6cf9-v2qp) Root directory disclosure via unescaped regex interpolation in `Rack::Directory`.
434
- - [CVE-2026-34230](https://github.com/advisories/GHSA-v569-hp3g-36wr) Avoid O(n^2) algorithm in `Rack::Utils.select_best_encoding` which could lead to denial of service.
435
- - [CVE-2026-26961](https://github.com/advisories/GHSA-vgpv-f759-9wx3) Raise error for multipart requests with multiple boundary parameters.
436
- - [CVE-2026-34786](https://github.com/advisories/GHSA-q4qf-9j86-f5mh) `Rack::Static` `header_rules` bypass via URL-encoded path mismatch.
437
- - [CVE-2026-34831](https://github.com/advisories/GHSA-q2ww-5357-x388) `Content-Length` mismatch in `Rack::Files` error responses.
438
- - [CVE-2026-34826](https://github.com/advisories/GHSA-x8cg-fq8g-mxfx) Multipart byte range processing allows denial of service via excessive overlapping ranges.
439
- - [CVE-2026-34830](https://github.com/advisories/GHSA-qv7j-4883-hwh7) `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`.
440
- - [CVE-2026-34785](https://github.com/advisories/GHSA-h2jq-g4cq-5ppq) `Rack::Static` prefix matching can expose unintended files under the static root.
441
- - [CVE-2026-34829](https://github.com/advisories/GHSA-8vqr-qjwx-82mw) Multipart parsing without `Content-Length` header allows unbounded chunked file uploads.
442
-
443
- ## [2.2.22] - 2026-02-16
444
-
445
- ### Security
446
-
447
- - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
448
- - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
449
-
450
- ## [2.2.21] - 2025-11-03
451
-
452
- ### Fixed
453
-
454
- - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
455
-
456
- ## [2.2.20] - 2025-10-10
457
-
458
- ### Security
459
-
460
- - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
461
- - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
462
-
463
- ## [2.2.19] - 2025-10-07
464
-
465
- ### Security
466
-
467
- - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
468
- - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
469
- - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
470
-
471
- ## [2.2.18] - 2025-09-25
472
-
473
- ### Security
474
-
475
- - [CVE-2025-59830](https://github.com/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
476
-
477
423
  ## [2.2.17] - 2025-06-03
478
424
 
479
425
  - Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
@@ -488,27 +434,29 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
488
434
 
489
435
  ## [2.2.14] - 2025-05-06
490
436
 
437
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
438
+
491
439
  ### Security
492
440
 
493
- - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
441
+ - [CVE-2025-46727](https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
494
442
 
495
443
  ## [2.2.13] - 2025-03-11
496
444
 
497
445
  ### Security
498
446
 
499
- - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
447
+ - [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
500
448
 
501
449
  ## [2.2.12] - 2025-03-04
502
450
 
503
451
  ### Security
504
452
 
505
- - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
453
+ - [CVE-2025-27111](https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
506
454
 
507
455
  ## [2.2.11] - 2025-02-12
508
456
 
509
457
  ### Security
510
458
 
511
- - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
459
+ - [CVE-2025-25184](https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
512
460
 
513
461
  ## [2.2.10] - 2024-10-14
514
462
 
@@ -1274,3 +1222,5 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
1274
1222
  [@BlakeWilliams]: https://github.com/BlakeWilliams "Blake Williams"
1275
1223
  [@davidstosik]: https://github.com/davidstosik "David Stosik"
1276
1224
  [@earlopain]: https://github.com/earlopain "Earlopain"
1225
+ [@wynksaiddestroy]: https://github.com/wynksaiddestroy "Fabian Winkler"
1226
+ [@matthewd]: https://github.com/matthewd "Matthew Draper"
data/README.md CHANGED
@@ -6,26 +6,43 @@ way possible, it unifies and distills the bridge between web servers, web
6
6
  frameworks, and web application into a single method call.
7
7
 
8
8
  The exact details of this are described in the [Rack Specification], which all
9
- Rack applications should conform to.
9
+ Rack applications should conform to. Browse the [Documentation] for more
10
+ information.
10
11
 
11
12
  ## Version support
12
13
 
13
14
  | Version | Support |
14
15
  |----------|------------------------------------|
15
- | 3.0.x | Bug fixes and security patches. |
16
+ | 3.2.x | Bug fixes and security patches. |
17
+ | 3.1.x | Security patches only. |
18
+ | 3.0.x | End of support. |
16
19
  | 2.2.x | Security patches only. |
17
20
  | <= 2.1.x | End of support. |
18
21
 
22
+ **Rack 2.2.x is in security maintenance mode**. Please upgrade to Rack 3.1+ as soon
23
+ as possible to ensure you are receiving the latest features and security patches.
24
+
19
25
  Please see the [Security Policy] for more information.
20
26
 
21
- ## Rack 3.0
27
+ ## Change log
28
+
29
+ See the [Changelog](CHANGELOG.md) for a detailed list of changes in each version of Rack.
30
+
31
+ ### Rack 3.2 (latest release)
32
+
33
+ This version of rack contains bug fixes and security patches.
34
+
35
+ ### Rack 3.1
22
36
 
23
- This is the latest version of Rack. It contains API improvements but also some
24
- breaking changes. Please check the [Upgrade Guide](UPGRADE-GUIDE.md) for more
25
- details about migrating servers, middlewares and applications designed for Rack 2
26
- to Rack 3. For detailed information on specific changes, check the [Change Log](CHANGELOG.md).
37
+ This version of rack contains bug fixes and security patches.
27
38
 
28
- ## Rack 2.2
39
+ ### Rack 3.0
40
+
41
+ This version of rack contains significant changes which are detailed in the
42
+ [Upgrade Guide](UPGRADE-GUIDE.md). It is recommended to upgrade to Rack 3 as soon
43
+ as possible to receive the latest features and security patches.
44
+
45
+ ### Rack 2.2
29
46
 
30
47
  This version of Rack is receiving security patches only, and effort should be
31
48
  made to move to Rack 3.
@@ -69,6 +86,8 @@ server](#supported-web-servers).
69
86
  ```bash
70
87
  $ gem install rackup
71
88
  $ rackup
89
+
90
+ # In another shell:
72
91
  $ curl http://localhost:9292
73
92
  Hello World
74
93
  ```
@@ -83,6 +102,7 @@ Rack is supported by a wide range of servers, including:
83
102
  * [NGINX Unit](https://unit.nginx.org/)
84
103
  * [Phusion Passenger](https://www.phusionpassenger.com/) (which is mod_rack for
85
104
  Apache and for nginx)
105
+ * [Pitchfork](https://github.com/Shopify/pitchfork)
86
106
  * [Puma](https://puma.io/)
87
107
  * [Thin](https://github.com/macournoyer/thin)
88
108
  * [Unicorn](https://yhbt.net/unicorn/)
@@ -132,11 +152,9 @@ middleware:
132
152
  * `Rack::ETag` for setting `etag` header on bodies that can be buffered.
133
153
  * `Rack::Events` for providing easy hooks when a request is received and when
134
154
  the response is sent.
135
- * `Rack::Files` for serving static files.
136
155
  * `Rack::Head` for returning an empty body for HEAD requests.
137
156
  * `Rack::Lint` for checking conformance to the [Rack Specification].
138
157
  * `Rack::Lock` for serializing requests using a mutex.
139
- * `Rack::Logger` for setting a logger to handle logging errors.
140
158
  * `Rack::MethodOverride` for modifying the request method based on a submitted
141
159
  parameter.
142
160
  * `Rack::Recursive` for including data from other paths in the application, and
@@ -150,7 +168,7 @@ middleware:
150
168
  a nice and helpful way with clickable backtrace.
151
169
  * `Rack::ShowStatus` for using nice error pages for empty client error
152
170
  responses.
153
- * `Rack::Static` for more configurable serving of static files.
171
+ * `Rack::Static` for configurable serving of static files.
154
172
  * `Rack::TempfileReaper` for removing temporary files creating during a request.
155
173
 
156
174
  All these components use the same interface, which is described in detail in the
@@ -172,6 +190,8 @@ quickly and without doing the same web stuff all over:
172
190
  returns a not found or method not supported response.
173
191
  * `Rack::Directory` for serving files under a given directory, with directory
174
192
  indexes.
193
+ * `Rack::Files` for serving files under a given directory, without directory
194
+ indexes.
175
195
  * `Rack::MediaType` for parsing content-type headers.
176
196
  * `Rack::Mime` for determining content-type based on file extension.
177
197
  * `Rack::RewindableInput` for making any IO object rewindable, using a temporary
@@ -210,14 +230,6 @@ query string, before attempting parsing, so if the same parameter key is
210
230
  used multiple times in the query, each counts as a separate parameter for
211
231
  this check.
212
232
 
213
- ### `RACK_MULTIPART_BUFFERED_UPLOAD_BYTESIZE_LIMIT`
214
-
215
- This environment variable sets the maximum amount of memory Rack will use
216
- to buffer multipart parameters when parsing a request body. This considers
217
- the size of the multipart mime headers and the body part for multipart
218
- parameters that are buffered in memory and do not use tempfiles. This
219
- defaults to 16MB if not provided.
220
-
221
233
  ### `param_depth_limit`
222
234
 
223
235
  ```ruby
@@ -255,7 +267,6 @@ Can also be set via the `RACK_MULTIPART_FILE_LIMIT` environment variable.
255
267
 
256
268
  (This is also aliased as `multipart_part_limit` and `RACK_MULTIPART_PART_LIMIT` for compatibility)
257
269
 
258
-
259
270
  ### `multipart_total_part_limit`
260
271
 
261
272
  The maximum total number of parts a request can contain of any type, including
@@ -268,18 +279,12 @@ Set to 0 for no limit.
268
279
 
269
280
  Can also be set via the `RACK_MULTIPART_TOTAL_PART_LIMIT` environment variable.
270
281
 
271
-
272
- ## Changelog
273
-
274
- See [CHANGELOG.md](CHANGELOG.md).
275
-
276
282
  ## Contributing
277
283
 
278
284
  See [CONTRIBUTING.md](CONTRIBUTING.md) for specific details about how to make a
279
285
  contribution to Rack.
280
286
 
281
- Please post bugs, suggestions and patches to [GitHub
282
- Issues](https://github.com/rack/rack/issues).
287
+ Please post bugs, suggestions and patches to [GitHub Issues](https://github.com/rack/rack/issues).
283
288
 
284
289
  Please check our [Security Policy](https://github.com/rack/rack/security/policy)
285
290
  for responsible disclosure and security bug reporting process. Due to wide usage
@@ -289,6 +294,13 @@ is greatly appreciated.
289
294
 
290
295
  ## See Also
291
296
 
297
+ ### `rackup`
298
+
299
+ A useful tool for running Rack applications from the command line, including
300
+ `Rackup::Server` (previously `Rack::Server`) for scripting servers.
301
+
302
+ * https://github.com/rack/rackup
303
+
292
304
  ### `rack-contrib`
293
305
 
294
306
  The plethora of useful middleware created the need for a project that collects
@@ -359,5 +371,6 @@ would like to thank:
359
371
 
360
372
  Rack is released under the [MIT License](MIT-LICENSE).
361
373
 
362
- [Rack Specification]: SPEC.rdoc
374
+ [Rack Specification]: https://rack.github.io/rack/main/SPEC_rdoc.html
375
+ [Documentation]: https://rack.github.io/rack/
363
376
  [Security Policy]: SECURITY.md