rack 3.1.8 → 3.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +319 -3
  3. data/README.md +76 -20
  4. data/SPEC.rdoc +199 -306
  5. data/lib/rack/auth/abstract/request.rb +2 -0
  6. data/lib/rack/builder.rb +6 -0
  7. data/lib/rack/common_logger.rb +3 -2
  8. data/lib/rack/conditional_get.rb +4 -3
  9. data/lib/rack/constants.rb +1 -0
  10. data/lib/rack/directory.rb +5 -2
  11. data/lib/rack/etag.rb +3 -0
  12. data/lib/rack/events.rb +21 -6
  13. data/lib/rack/head.rb +2 -3
  14. data/lib/rack/lint.rb +430 -457
  15. data/lib/rack/media_type.rb +14 -10
  16. data/lib/rack/mock_response.rb +37 -5
  17. data/lib/rack/multipart/parser.rb +91 -13
  18. data/lib/rack/multipart/uploaded_file.rb +42 -5
  19. data/lib/rack/query_parser.rb +81 -20
  20. data/lib/rack/request.rb +49 -55
  21. data/lib/rack/rewindable_input.rb +4 -1
  22. data/lib/rack/sendfile.rb +51 -21
  23. data/lib/rack/show_exceptions.rb +4 -2
  24. data/lib/rack/show_status.rb +0 -2
  25. data/lib/rack/static.rb +2 -1
  26. data/lib/rack/utils.rb +14 -23
  27. data/lib/rack/version.rb +4 -8
  28. data/lib/rack.rb +0 -1
  29. metadata +5 -8
  30. data/lib/rack/logger.rb +0 -23
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: cd9b9438930771f3687ff42be3f3506df2faeea5d947d8ed4fa9e5eec1b5970c
4
- data.tar.gz: 170b7d3e30e472e5a5403f9bb889f37b60e4e9eced41e94f97a88d848e5c2fb4
3
+ metadata.gz: dcab43418ebec9227dad4a8e8fbfeb403097a3c34bcebc63a230350984c68ab9
4
+ data.tar.gz: 6b82c8e25fa9bc835cfe24a05da9731bd9a0654b40a56a01c6f77ac7fc7029f4
5
5
  SHA512:
6
- metadata.gz: 0a5c0c56cda8181c7ec4e87a348b54a22938d4c450a9647fbbf07aaec37282ff89230d3964ba0dfd9f5bc7f7e60d99eaf704636de143704c5e9156120bd04624
7
- data.tar.gz: eeef987e1c6dc77ff1fc40e5cc0e37bde704d354c62217a834e6a4d36828900a71dac09e591a9743273fc5ea678bf603d36c3e165f9c7dbfa1759301c42f957f
6
+ metadata.gz: a727df6903901d26a8d4e031302cb0c5b45134b9e31b2443b6e4d4a595233f4d18d58ff265cafbd9e344e4b7958fd3d27b6e46d57c6f37c9744617da8eba6db4
7
+ data.tar.gz: 8c914906cc9c4d0610ab8dc0de815cb714311261dc50ef6d1a6c1b5ecacd9d3f58e477014176a0044dd1f1dd24ecc55554eb6eebe78995205bd6c47bee83d9eb
data/CHANGELOG.md CHANGED
@@ -2,8 +2,166 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
4
4
 
5
+ ## Unreleased
6
+
7
+ ### Security
8
+
9
+ - [CVE-2026-25500](https://github.com/advisories/GHSA-whrj-4476-wvmp) XSS injection via malicious filename in `Rack::Directory`.
10
+ - [CVE-2026-22860](https://github.com/advisories/GHSA-mxw3-3hh2-x2mh) Directory traversal via root prefix bypass in `Rack::Directory`.
11
+
12
+ ### Fixed
13
+
14
+ - Fix `Rack::MockResponse#body` when the body is a Proc. ([#2420](https://github.com/rack/rack/pull/2420), [#2423](https://github.com/rack/rack/pull/2423), [@tavianator](https://github.com/tavianator), [@ioquatix])
15
+
16
+ ## [3.2.4] - 2025-11-03
17
+
18
+ ### Fixed
19
+
20
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
21
+
22
+ ## [3.2.3] - 2025-10-10
23
+
24
+ ### Security
25
+
26
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
27
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
28
+
29
+ ## [3.2.2] - 2025-10-07
30
+
31
+ ### Security
32
+
33
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
34
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
35
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
36
+
37
+ ## [3.2.1] -- 2025-09-02
38
+
39
+ ### Added
40
+
41
+ - Add support for streaming bodies when using `Rack::Events`. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
42
+
43
+ ### Fixed
44
+
45
+ - Fix an issue where a `NoMethodError` would be raised when using `Rack::Events` with streaming bodies. ([#2375](github.com/rack/rack/pull/2375), [@unflxw](https://github.com/unflxw))
46
+
47
+ ## [3.2.0] - 2025-07-31
48
+
49
+ This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.
50
+
51
+ ### SPEC Changes
52
+
53
+ - Request environment keys must now be strings. ([#2310](https://github.com/rack/rack/issues/2310), [@jeremyevans])
54
+ - Add `nil` as a valid return from a Response `body.to_path` ([#2318](https://github.com/rack/rack/pull/2318), [@MSP-Greg])
55
+ - `Rack::Lint#check_header_value` is relaxed, only disallowing CR/LF/NUL characters. ([#2354](https://github.com/rack/rack/pull/2354), [@ioquatix])
56
+
57
+ ### Added
58
+
59
+ - Introduce `Rack::VERSION` constant. ([#2199](https://github.com/rack/rack/pull/2199), [@ioquatix])
60
+ - `ISO-2022-JP` encoded parts within MIME Multipart sections of an HTTP request body will now be converted to `UTF-8`. ([#2245](https://github.com/rack/rack/pull/2245), [@nappa](https://github.com/nappa))
61
+ - Add `Rack::Request#query_parser=` to allow setting the query parser to use. ([#2349](https://github.com/rack/rack/pull/2349), [@jeremyevans])
62
+ - Add `Rack::Request#form_pairs` to access form data as raw key-value pairs, preserving duplicate keys. ([#2351](https://github.com/rack/rack/pull/2351), [@matthewd])
63
+
64
+ ### Changed
65
+
66
+ - Invalid cookie keys will now raise an error. ([#2193](https://github.com/rack/rack/pull/2193), [@ioquatix])
67
+ - `Rack::MediaType#params` now handles empty strings. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
68
+ - Avoid unnecessary calls to the `ip_filter` lambda to evaluate `Request#ip` ([#2287](https://github.com/rack/rack/pull/2287), [@willbryant])
69
+ - Only calculate `Request#ip` once per request ([#2292](https://github.com/rack/rack/pull/2292), [@willbryant])
70
+ - `Rack::Builder` `#use`, `#map`, and `#run` methods now return `nil`. ([#2355](https://github.com/rack/rack/pull/2355), [@ioquatix])
71
+ - Directly close the body in `Rack::ConditionalGet` when the response is `304 Not Modified`. ([#2353](https://github.com/rack/rack/pull/2353), [@ioquatix])
72
+ - Directly close the body in `Rack::Head` when the request method is `HEAD`([#2360](https://github.com/rack/rack/pull/2360), [@skipkayhil](https://github.com/skipkayhil))
73
+
74
+ ### Deprecated
75
+
76
+ - `Rack::Auth::AbstractRequest#request` is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
77
+ - `Rack::Request#parse_multipart` (private method designed to be overridden in subclasses) is deprecated without replacement. ([#2229](https://github.com/rack/rack/pull/2229), [@jeremyevans])
78
+
79
+ ### Removed
80
+
81
+ - `Rack::Request#values_at` is removed. ([#2200](https://github.com/rack/rack/pull/2200), [@ioquatix])
82
+ - `Rack::Logger` is removed with no replacement. ([#2196](https://github.com/rack/rack/pull/2196), [@ioquatix])
83
+ - Automatic cache invalidation in `Rack::Request#{GET,POST}` has been removed. ([#2230](https://github.com/rack/rack/pull/2230), [@jeremyevans])
84
+ - Support for `CGI::Cookie` has been removed. ([#2332](https://github.com/rack/rack/pull/2332), [@ioquatix])
85
+
86
+ ### Fixed
87
+
88
+ - `Rack::RewindableInput::Middleware` no longer wraps a nil input. ([#2259](https://github.com/rack/rack/pull/2259), [@tt](https://github.com/tt))
89
+ - Fix `NoMethodError` in `Rack::Request#wrap_ipv6` when `x-forwarded-host` is empty. ([#2270](https://github.com/rack/rack/pull/2270), [@oieioi](https://github.com/oieioi))
90
+ - Fix the specification for `SERVER_PORT` which was incorrectly documented as required to be an `Integer` if present - it must be a `String` containing digits only. ([#2296](https://github.com/rack/rack/pull/2296), [@ioquatix])
91
+ - `SERVER_NAME` and `HTTP_HOST` are now more strictly validated according to the relevant specifications. ([#2298](https://github.com/rack/rack/pull/2298), [@ioquatix])
92
+ - `Rack::Lint` now disallows `PATH_INFO="" SCRIPT_NAME=""`. ([#2298](https://github.com/rack/rack/issues/2307), [@jeremyevans])
93
+
94
+ ## [3.1.19] - 2025-11-03
95
+
96
+ ### Fixed
97
+
98
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
99
+
100
+ ## [3.1.18] - 2025-10-10
101
+
102
+ ### Security
103
+
104
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
105
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
106
+
107
+ ## [3.1.17] - 2025-10-07
108
+
109
+ ### Security
110
+
111
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
112
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
113
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
114
+
115
+ ## [3.1.16] - 2025-06-04
116
+
117
+ ### Security
118
+
119
+ - [CVE-2025-49007](https://github.com/advisories/GHSA-47m2-26rw-j2jw) Fix ReDoS in multipart request.
120
+
121
+ ## [3.1.15] - 2025-05-18
122
+
123
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
124
+
125
+ ## [3.1.14] - 2025-05-06
126
+
127
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
128
+
129
+ ### Security
130
+
131
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
132
+
133
+ ## [3.1.13] - 2025-04-13
134
+
135
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
136
+
137
+ ## [3.1.12] - 2025-03-11
138
+
139
+ ### Security
140
+
141
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
142
+
143
+ ## [3.1.11] - 2025-03-04
144
+
145
+ ### Security
146
+
147
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
148
+
149
+ ## [3.1.10] - 2025-02-12
150
+
151
+ ### Security
152
+
153
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
154
+
155
+ ## [3.1.9] - 2025-01-31
156
+
157
+ ### Fixed
158
+
159
+ - `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
160
+
5
161
  ## [3.1.8] - 2024-10-14
6
162
 
163
+ ### Fixed
164
+
7
165
  - Resolve deprecation warnings about uri `DEFAULT_PARSER`. ([#2249](https://github.com/rack/rack/pull/2249), [@earlopain])
8
166
 
9
167
  ## [3.1.7] - 2024-07-11
@@ -25,7 +183,7 @@ All notable changes to this project will be documented in this file. For info on
25
183
 
26
184
  ### Security
27
185
 
28
- - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
186
+ - Fix potential ReDoS attack in `Rack::Request#parse_http_accept_header`. ([GHSA-cj83-2ww7-mvq7](https://github.com/advisories/GHSA-cj83-2ww7-mvq7), [@dwisiswant0](https://github.com/dwisiswant0))
29
187
 
30
188
  ## [3.1.4] - 2024-06-22
31
189
 
@@ -52,7 +210,7 @@ All notable changes to this project will be documented in this file. For info on
52
210
 
53
211
  :warning: **This release includes several breaking changes.** Refer to the **Removed** section below for the list of deprecated methods that have been removed in this release.
54
212
 
55
- Rack v3.1 is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
213
+ This release is primarily a maintenance release that removes features deprecated in Rack v3.0. Alongside these removals, there are several improvements to the Rack SPEC, mainly focused on enhancing input and output handling. These changes aim to make Rack more efficient and align better with the requirements of server implementations and relevant HTTP specifications.
56
214
 
57
215
  ### SPEC Changes
58
216
 
@@ -103,6 +261,48 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
103
261
 
104
262
  - In `Rack::Files`, ignore the `Range` header if served file is 0 bytes. ([#2159](https://github.com/rack/rack/pull/2159), [@zarqman])
105
263
 
264
+ ## [3.0.18] - 2025-05-22
265
+
266
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
267
+
268
+ ## [3.0.17] - 2025-05-18
269
+
270
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
271
+
272
+ ## [3.0.16] - 2025-05-06
273
+
274
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
275
+
276
+ ### Security
277
+
278
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
279
+
280
+ ## [3.0.15] - 2025-04-13
281
+
282
+ - Ensure `Rack::ETag` correctly updates response body. ([#2324](https://github.com/rack/rack/pull/2324), [@ioquatix])
283
+
284
+ ## [3.0.14] - 2025-03-11
285
+
286
+ ### Security
287
+
288
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
289
+
290
+ ## [3.0.13] - 2025-03-04
291
+
292
+ ### Security
293
+
294
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
295
+
296
+ ### Fixed
297
+
298
+ - Remove autoloads for constants no longer shipped with Rack. ([#2269](https://github.com/rack/rack/pull/2269), [@ccutrer](https://github.com/ccutrer))
299
+
300
+ ## [3.0.12] - 2025-02-12
301
+
302
+ ### Security
303
+
304
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
305
+
106
306
  ## [3.0.11] - 2024-05-10
107
307
 
108
308
  - Backport #2062 to 3-0-stable: Do not allow `BodyProxy` to respond to `to_str`, make `to_ary` call close . ([#2062](https://github.com/rack/rack/pull/2062), [@jeremyevans](https://github.com/jeremyevans))
@@ -191,6 +391,8 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
191
391
 
192
392
  ## [3.0.0] - 2022-09-06
193
393
 
394
+ This release introduces major improvements to Rack, including enhanced support for streaming responses, expanded protocol handling, and stricter compliance with HTTP standards. It refines middleware interfaces, improves multipart and hijack handling, and strengthens security and error reporting. The update also brings performance optimizations, better compatibility with modern Ruby versions, and numerous bug fixes, making Rack more robust and flexible for web application development.
395
+
194
396
  - No changes
195
397
 
196
398
  ## [3.0.0.rc1] - 2022-09-04
@@ -231,7 +433,7 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
231
433
  - Remove deprecated Rack::Request::SCHEME_WHITELIST. ([@jeremyevans])
232
434
  - Remove internal cookie deletion using pattern matching, there are very few practical cases where it would be useful and browsers handle it correctly without us doing anything special. ([#1844](https://github.com/rack/rack/pull/1844), [@ioquatix])
233
435
  - Remove `rack.version` as it comes too late to be useful. ([#1938](https://github.com/rack/rack/pull/1938), [@ioquatix])
234
- - Extract `rackup` command, `Rack::Server`, `Rack::Handler`, `Rack::Lobster` and related code into a separate gem. ([#1937](https://github.com/rack/rack/pull/1937), [@ioquatix])
436
+ - Extract `rackup` command, `Rack::Server`, `Rack::Handler` and related code into a separate gem. ([#1937](https://github.com/rack/rack/pull/1937), [@ioquatix])
235
437
 
236
438
  ### Added
237
439
 
@@ -279,6 +481,117 @@ Rack v3.1 is primarily a maintenance release that removes features deprecated in
279
481
  - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
280
482
  - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
281
483
 
484
+ ## [2.2.21] - 2025-11-03
485
+
486
+ ### Fixed
487
+
488
+ - Multipart parser: limit MIME header size check to the unread buffer region to avoid false `multipart mime part header too large` errors when previously read data accumulates in the scan buffer. ([#2392](https://github.com/rack/rack/pull/2392), [@alpaca-tc](https://github.com/alpaca-tc), [@willnet](https://github.com/willnet), [@krororo](https://github.com/krororo))
489
+
490
+ ## [2.2.20] - 2025-10-10
491
+
492
+ ### Security
493
+
494
+ - [CVE-2025-61780](https://github.com/advisories/GHSA-r657-rxjc-j557) Improper handling of headers in `Rack::Sendfile` may allow proxy bypass.
495
+ - [CVE-2025-61919](https://github.com/advisories/GHSA-6xw4-3v39-52mm) Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion.
496
+
497
+ ## [2.2.19] - 2025-10-07
498
+
499
+ ### Security
500
+
501
+ - [CVE-2025-61772](https://github.com/advisories/GHSA-wpv5-97wm-hp9c) Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
502
+ - [CVE-2025-61771](https://github.com/advisories/GHSA-w9pc-fmgc-vxvw) Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
503
+ - [CVE-2025-61770](https://github.com/advisories/GHSA-p543-xpfm-54cp) Unbounded multipart preamble buffering enables DoS (memory exhaustion)
504
+
505
+ ## [2.2.18] - 2025-09-25
506
+
507
+ ### Security
508
+
509
+ - [CVE-2025-59830](https://github.com/advisories/GHSA-625h-95r8-8xpm) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion via semicolon-separated parameters.
510
+
511
+ ## [2.2.17] - 2025-06-03
512
+
513
+ - Backport `Rack::MediaType#params` now handles parameters without values. ([#2263](https://github.com/rack/rack/pull/2263), [@AllyMarthaJ](https://github.com/AllyMarthaJ))
514
+
515
+ ## [2.2.16] - 2025-05-22
516
+
517
+ - Fix incorrect backport of optional `CGI::Cookie` support. ([#2335](https://github.com/rack/rack/pull/2335), [@jeremyevans])
518
+
519
+ ## [2.2.15] - 2025-05-18
520
+
521
+ - Optional support for `CGI::Cookie` if not available. ([#2327](https://github.com/rack/rack/pull/2327), [#2333](https://github.com/rack/rack/pull/2333), [@earlopain])
522
+
523
+ ## [2.2.14] - 2025-05-06
524
+
525
+ :warning: **This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See <https://github.com/rack/rack/discussions/2356> for more details.**
526
+
527
+ ### Security
528
+
529
+ - [CVE-2025-46727](https://github.com/advisories/GHSA-gjh7-p2fx-99vx) Unbounded parameter parsing in `Rack::QueryParser` can lead to memory exhaustion.
530
+
531
+ ## [2.2.13] - 2025-03-11
532
+
533
+ ### Security
534
+
535
+ - [CVE-2025-27610](https://github.com/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
536
+
537
+ ## [2.2.12] - 2025-03-04
538
+
539
+ ### Security
540
+
541
+ - [CVE-2025-27111](https://github.com/advisories/GHSA-8cgq-6mh2-7j6v) Possible Log Injection in `Rack::Sendfile`.
542
+
543
+ ## [2.2.11] - 2025-02-12
544
+
545
+ ### Security
546
+
547
+ - [CVE-2025-25184](https://github.com/advisories/GHSA-7g2v-jj9q-g3rg) Possible Log Injection in `Rack::CommonLogger`.
548
+
549
+ ## [2.2.10] - 2024-10-14
550
+
551
+ - Fix compatibility issues with Ruby v3.4.0. ([#2248](https://github.com/rack/rack/pull/2248), [@byroot](https://github.com/byroot))
552
+
553
+ ## [2.2.9] - 2023-03-21
554
+
555
+ - Return empty when parsing a multi-part POST with only one end delimiter. ([#2104](https://github.com/rack/rack/pull/2104), [@alpaca-tc])
556
+
557
+ ## [2.2.8] - 2023-07-31
558
+
559
+ - Regenerate SPEC ([#2102](https://github.com/rack/rack/pull/2102), [@skipkayhil](https://github.com/skipkayhil))
560
+ - Limit file extension length of multipart tempfiles ([#2015](https://github.com/rack/rack/pull/2015), [@dentarg](https://github.com/dentarg))
561
+ - Fix "undefined method DelegateClass for Rack::Session::Cookie:Class" ([#2092](https://github.com/rack/rack/pull/2092), [@onigra](https://github.com/onigra) [@dchandekstark](https://github.com/dchandekstark))
562
+
563
+ ## [2.2.7] - 2023-03-13
564
+
565
+ - Correct the year number in the changelog ([#2015](https://github.com/rack/rack/pull/2015), [@kimulab](https://github.com/kimulab))
566
+ - Support underscore in host names for Rack 2.2 (Fixes [#2070](https://github.com/rack/rack/issues/2070)) ([#2015](https://github.com/rack/rack/pull/2071), [@jeremyevans](https://github.com/jeremyevans))
567
+
568
+ ## [2.2.6.4] - 2023-03-13
569
+
570
+ - [CVE-2023-27539] Avoid ReDoS in header parsing
571
+
572
+ ## [2.2.6.3] - 2023-03-02
573
+
574
+ - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts
575
+
576
+ ## [2.2.6.2] - 2023-01-17
577
+
578
+ - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
579
+
580
+ ## [2.2.6.1] - 2023-01-17
581
+
582
+ - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
583
+ - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
584
+
585
+ ## [2.2.6] - 2023-01-17
586
+
587
+ - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
588
+
589
+ ## [2.2.5] - 2022-12-27
590
+
591
+ ### Fixed
592
+
593
+ - `Rack::URLMap` uses non-deprecated form of `Regexp.new`. ([#1998](https://github.com/rack/rack/pull/1998), [@weizheheng](https://github.com/weizheheng))
594
+
282
595
  ## [2.2.4] - 2022-06-30
283
596
 
284
597
  - Better support for lower case headers in `Rack::ETag` middleware. ([#1919](https://github.com/rack/rack/pull/1919), [@ioquatix](https://github.com/ioquatix))
@@ -996,3 +1309,6 @@ Items below this line are from the previously maintained HISTORY.md and NEWS.md
996
1309
  [@wjordan]: https://github.com/wjordan "Will Jordan"
997
1310
  [@BlakeWilliams]: https://github.com/BlakeWilliams "Blake Williams"
998
1311
  [@davidstosik]: https://github.com/davidstosik "David Stosik"
1312
+ [@earlopain]: https://github.com/earlopain "Earlopain"
1313
+ [@wynksaiddestroy]: https://github.com/wynksaiddestroy "Fabian Winkler"
1314
+ [@matthewd]: https://github.com/matthewd "Matthew Draper"
data/README.md CHANGED
@@ -6,26 +6,43 @@ way possible, it unifies and distills the bridge between web servers, web
6
6
  frameworks, and web application into a single method call.
7
7
 
8
8
  The exact details of this are described in the [Rack Specification], which all
9
- Rack applications should conform to.
9
+ Rack applications should conform to. Browse the [Documentation] for more
10
+ information.
10
11
 
11
12
  ## Version support
12
13
 
13
14
  | Version | Support |
14
15
  |----------|------------------------------------|
15
- | 3.0.x | Bug fixes and security patches. |
16
+ | 3.2.x | Bug fixes and security patches. |
17
+ | 3.1.x | Security patches only. |
18
+ | 3.0.x | End of support. |
16
19
  | 2.2.x | Security patches only. |
17
20
  | <= 2.1.x | End of support. |
18
21
 
22
+ **Rack 2.2.x is in security maintenance mode**. Please upgrade to Rack 3.1+ as soon
23
+ as possible to ensure you are receiving the latest features and security patches.
24
+
19
25
  Please see the [Security Policy] for more information.
20
26
 
21
- ## Rack 3.0
27
+ ## Change log
28
+
29
+ See the [Changelog](CHANGELOG.md) for a detailed list of changes in each version of Rack.
30
+
31
+ ### Rack 3.2 (latest release)
32
+
33
+ This version of rack contains bug fixes and security patches.
34
+
35
+ ### Rack 3.1
36
+
37
+ This version of rack contains bug fixes and security patches.
38
+
39
+ ### Rack 3.0
22
40
 
23
- This is the latest version of Rack. It contains API improvements but also some
24
- breaking changes. Please check the [Upgrade Guide](UPGRADE-GUIDE.md) for more
25
- details about migrating servers, middlewares and applications designed for Rack 2
26
- to Rack 3. For detailed information on specific changes, check the [Change Log](CHANGELOG.md).
41
+ This version of rack contains significant changes which are detailed in the
42
+ [Upgrade Guide](UPGRADE-GUIDE.md). It is recommended to upgrade to Rack 3 as soon
43
+ as possible to receive the latest features and security patches.
27
44
 
28
- ## Rack 2.2
45
+ ### Rack 2.2
29
46
 
30
47
  This version of Rack is receiving security patches only, and effort should be
31
48
  made to move to Rack 3.
@@ -69,6 +86,8 @@ server](#supported-web-servers).
69
86
  ```bash
70
87
  $ gem install rackup
71
88
  $ rackup
89
+
90
+ # In another shell:
72
91
  $ curl http://localhost:9292
73
92
  Hello World
74
93
  ```
@@ -83,6 +102,7 @@ Rack is supported by a wide range of servers, including:
83
102
  * [NGINX Unit](https://unit.nginx.org/)
84
103
  * [Phusion Passenger](https://www.phusionpassenger.com/) (which is mod_rack for
85
104
  Apache and for nginx)
105
+ * [Pitchfork](https://github.com/Shopify/pitchfork)
86
106
  * [Puma](https://puma.io/)
87
107
  * [Thin](https://github.com/macournoyer/thin)
88
108
  * [Unicorn](https://yhbt.net/unicorn/)
@@ -132,11 +152,9 @@ middleware:
132
152
  * `Rack::ETag` for setting `etag` header on bodies that can be buffered.
133
153
  * `Rack::Events` for providing easy hooks when a request is received and when
134
154
  the response is sent.
135
- * `Rack::Files` for serving static files.
136
155
  * `Rack::Head` for returning an empty body for HEAD requests.
137
156
  * `Rack::Lint` for checking conformance to the [Rack Specification].
138
157
  * `Rack::Lock` for serializing requests using a mutex.
139
- * `Rack::Logger` for setting a logger to handle logging errors.
140
158
  * `Rack::MethodOverride` for modifying the request method based on a submitted
141
159
  parameter.
142
160
  * `Rack::Recursive` for including data from other paths in the application, and
@@ -150,7 +168,7 @@ middleware:
150
168
  a nice and helpful way with clickable backtrace.
151
169
  * `Rack::ShowStatus` for using nice error pages for empty client error
152
170
  responses.
153
- * `Rack::Static` for more configurable serving of static files.
171
+ * `Rack::Static` for configurable serving of static files.
154
172
  * `Rack::TempfileReaper` for removing temporary files creating during a request.
155
173
 
156
174
  All these components use the same interface, which is described in detail in the
@@ -172,6 +190,8 @@ quickly and without doing the same web stuff all over:
172
190
  returns a not found or method not supported response.
173
191
  * `Rack::Directory` for serving files under a given directory, with directory
174
192
  indexes.
193
+ * `Rack::Files` for serving files under a given directory, without directory
194
+ indexes.
175
195
  * `Rack::MediaType` for parsing content-type headers.
176
196
  * `Rack::Mime` for determining content-type based on file extension.
177
197
  * `Rack::RewindableInput` for making any IO object rewindable, using a temporary
@@ -183,6 +203,41 @@ quickly and without doing the same web stuff all over:
183
203
  Rack exposes several configuration parameters to control various features of the
184
204
  implementation.
185
205
 
206
+ ### `RACK_QUERY_PARSER_BYTESIZE_LIMIT`
207
+
208
+ This environment variable sets the default for the maximum query string bytesize
209
+ that `Rack::QueryParser` will attempt to parse. Attempts to use a query string
210
+ that exceeds this number of bytes will result in a
211
+ `Rack::QueryParser::QueryLimitError` exception. If this enviroment variable is
212
+ provided, it must be an integer, or `Rack::QueryParser` will raise an exception.
213
+
214
+ The default limit can be overridden on a per-`Rack::QueryParser` basis using
215
+ the `bytesize_limit` keyword argument when creating the `Rack::QueryParser`.
216
+
217
+ ### `RACK_QUERY_PARSER_PARAMS_LIMIT`
218
+
219
+ This environment variable sets the default for the maximum number of query
220
+ parameters that `Rack::QueryParser` will attempt to parse. Attempts to use a
221
+ query string with more than this many query parameters will result in a
222
+ `Rack::QueryParser::QueryLimitError` exception. If this enviroment variable is
223
+ provided, it must be an integer, or `Rack::QueryParser` will raise an exception.
224
+
225
+ The default limit can be overridden on a per-`Rack::QueryParser` basis using
226
+ the `params_limit` keyword argument when creating the `Rack::QueryParser`.
227
+
228
+ This is implemented by counting the number of parameter separators in the
229
+ query string, before attempting parsing, so if the same parameter key is
230
+ used multiple times in the query, each counts as a separate parameter for
231
+ this check.
232
+
233
+ ### `RACK_MULTIPART_BUFFERED_UPLOAD_BYTESIZE_LIMIT`
234
+
235
+ This environment variable sets the maximum amount of memory Rack will use
236
+ to buffer multipart parameters when parsing a request body. This considers
237
+ the size of the multipart mime headers and the body part for multipart
238
+ parameters that are buffered in memory and do not use tempfiles. This
239
+ defaults to 16MB if not provided.
240
+
186
241
  ### `param_depth_limit`
187
242
 
188
243
  ```ruby
@@ -220,7 +275,6 @@ Can also be set via the `RACK_MULTIPART_FILE_LIMIT` environment variable.
220
275
 
221
276
  (This is also aliased as `multipart_part_limit` and `RACK_MULTIPART_PART_LIMIT` for compatibility)
222
277
 
223
-
224
278
  ### `multipart_total_part_limit`
225
279
 
226
280
  The maximum total number of parts a request can contain of any type, including
@@ -233,18 +287,12 @@ Set to 0 for no limit.
233
287
 
234
288
  Can also be set via the `RACK_MULTIPART_TOTAL_PART_LIMIT` environment variable.
235
289
 
236
-
237
- ## Changelog
238
-
239
- See [CHANGELOG.md](CHANGELOG.md).
240
-
241
290
  ## Contributing
242
291
 
243
292
  See [CONTRIBUTING.md](CONTRIBUTING.md) for specific details about how to make a
244
293
  contribution to Rack.
245
294
 
246
- Please post bugs, suggestions and patches to [GitHub
247
- Issues](https://github.com/rack/rack/issues).
295
+ Please post bugs, suggestions and patches to [GitHub Issues](https://github.com/rack/rack/issues).
248
296
 
249
297
  Please check our [Security Policy](https://github.com/rack/rack/security/policy)
250
298
  for responsible disclosure and security bug reporting process. Due to wide usage
@@ -254,6 +302,13 @@ is greatly appreciated.
254
302
 
255
303
  ## See Also
256
304
 
305
+ ### `rackup`
306
+
307
+ A useful tool for running Rack applications from the command line, including
308
+ `Rackup::Server` (previously `Rack::Server`) for scripting servers.
309
+
310
+ * https://github.com/rack/rackup
311
+
257
312
  ### `rack-contrib`
258
313
 
259
314
  The plethora of useful middleware created the need for a project that collects
@@ -324,5 +379,6 @@ would like to thank:
324
379
 
325
380
  Rack is released under the [MIT License](MIT-LICENSE).
326
381
 
327
- [Rack Specification]: SPEC.rdoc
382
+ [Rack Specification]: https://rack.github.io/rack/main/SPEC_rdoc.html
383
+ [Documentation]: https://rack.github.io/rack/
328
384
  [Security Policy]: SECURITY.md