rack 1.3.2 → 1.3.3

data/README.rdoc

@@ -355,6 +355,12 @@ run on port 11211) and memcache-client installed.
 * July 16, 2011: Sixteenth public release 1.3.2
   * Fix for Rails and rack-test, Rack::Utils#escape calls to_s
 
+* September 16, 2011: Seventeenth public release 1.3.3
+  * Fix bug with broken query parameters in Rack::ShowExceptions
+  * Rack::Request#cookies no longer swallows exceptions on broken input
+  * Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
+  * Rack::ConditionalGet handles broken If-Modified-Since helpers
+
 == Contact
 
 Please post bugs, suggestions and patches to

data/Rakefile

@@ -64,13 +64,13 @@ file "SPEC" => 'lib/rack/lint.rb' do
   }
 end
 
-desc "Run all the fast tests"
+desc "Run all the fast + platform agnostic tests"
 task :test => 'SPEC' do
   opts     = ENV['TEST'] || '-a'
   specopts = ENV['TESTOPTS'] ||
-    "-q -t '^(?!Rack::Adapter|Rack::Session::Memcache|Rack::Server)'"
+    "-q -t '^(?!Rack::Adapter|Rack::Session::Memcache|Rack::Server|Rack::Handler)'"
 
-  sh "bacon -I./lib:./test -w #{opts} #{specopts}"
+  sh "bacon -I./lib:./test #{opts} #{specopts}"
 end
 
 desc "Run all the tests"

data/lib/rack/conditionalget.rb

@@ -56,6 +56,7 @@ module Rack
 
     def modified_since?(modified_since, headers)
       last_modified = to_rfc2822(headers['Last-Modified']) and
+        modified_since and
         modified_since >= last_modified
     end
 

data/lib/rack/request.rb

@@ -230,22 +230,22 @@ module Rack
     end
 
     def cookies
-      return {}  unless @env["HTTP_COOKIE"]
-
-      if @env["rack.request.cookie_string"] == @env["HTTP_COOKIE"]
-        @env["rack.request.cookie_hash"]
-      else
-        @env["rack.request.cookie_string"] = @env["HTTP_COOKIE"]
-        # According to RFC 2109:
-        #   If multiple cookies satisfy the criteria above, they are ordered in
-        #   the Cookie header such that those with more specific Path attributes
-        #   precede those with less specific.  Ordering with respect to other
-        #   attributes (e.g., Domain) is unspecified.
-        @env["rack.request.cookie_hash"] =
-          Hash[*Utils.parse_query(@env["rack.request.cookie_string"], ';,').map {|k,v|
-            [k, Array === v ? v.first : v]
-          }.flatten]
-      end
+      hash   = @env["rack.request.cookie_hash"] ||= {}
+      string = @env["HTTP_COOKIE"]
+
+      hash.clear unless string
+      return hash if string == @env["rack.request.cookie_string"]
+
+      # According to RFC 2109:
+      #   If multiple cookies satisfy the criteria above, they are ordered in
+      #   the Cookie header such that those with more specific Path attributes
+      #   precede those with less specific.  Ordering with respect to other
+      #   attributes (e.g., Domain) is unspecified.
+      Utils.parse_query(string, ';,').each { |k,v| hash[k] = Array === v ? v.first : v }
+      @env["rack.request.cookie_string"] = string
+      hash
+    rescue => error
+      raise error.class, "cannot parse Cookie header: #{error.message}"
     end
 
     def xhr?

data/lib/rack/sendfile.rb

@@ -80,7 +80,7 @@ module Rack
   #
   # X-Sendfile is supported under Apache 2.x using a separate module:
   #
-  # http://tn123.ath.cx/mod_xsendfile/
+  # https://tn123.org/mod_xsendfile/
   #
   # Once the module is compiled and installed, you can enable it using
   # XSendFile config directive:

data/lib/rack/showexceptions.rb

@@ -277,7 +277,7 @@ TEMPLATE = <<'HTML'
   <h2>Request information</h2>
 
   <h3 id="get-info">GET</h3>
-  <% unless req.GET.empty? %>
+  <% if req.GET and not req.GET.empty? %>
     <table class="req">
       <thead>
         <tr>
@@ -299,7 +299,7 @@ TEMPLATE = <<'HTML'
   <% end %>
 
   <h3 id="post-info">POST</h3>
-  <% unless req.POST.empty? %>
+  <% if req.POST and not req.POST.empty? %>
     <table class="req">
       <thead>
         <tr>

data/lib/rack/utils.rb

@@ -146,7 +146,13 @@ module Rack
       '"' => """,
       "/" => "/"
     }
-    ESCAPE_HTML_PATTERN = Regexp.union(*ESCAPE_HTML.keys)
+    if //.respond_to?(:encoding)
+      ESCAPE_HTML_PATTERN = Regexp.union(*ESCAPE_HTML.keys)
+    else
+      # On 1.8, there is a kcode = 'u' bug that allows for XSS otherwhise
+      # TODO doesn't apply to jruby, so a better condition above might be preferable?
+      ESCAPE_HTML_PATTERN = /#{Regexp.union(*ESCAPE_HTML.keys)}/n
+    end
 
     # Escape ampersands, brackets and quotes to their HTML/XML entities.
     def escape_html(string)

data/rack.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = "rack"
-  s.version         = "1.3.2"
+  s.version         = "1.3.3"
   s.platform        = Gem::Platform::RUBY
   s.summary         = "a modular Ruby webserver interface"
 

data/test/spec_conditionalget.rb

@@ -83,4 +83,16 @@ describe Rack::ConditionalGet do
     response.body.should.equal 'TEST'
   end
 
+  should "not affect requests with malformed HTTP_IF_NONE_MATCH" do
+    bad_timestamp = Time.now.strftime('%Y-%m-%d %H:%M:%S %z')
+    app = Rack::ConditionalGet.new(lambda { |env|
+      [200,{'Last-Modified'=>(Time.now - 3600).httpdate}, ['TEST']] })
+
+    response = Rack::MockRequest.new(app).
+      get("/", 'HTTP_IF_MODIFIED_SINCE' => bad_timestamp)
+
+    response.status.should.equal 200
+    response.body.should.equal 'TEST'
+  end
+
 end

data/test/spec_mock.rb

@@ -175,7 +175,8 @@ describe Rack::MockRequest do
     env["QUERY_STRING"].should.equal ""
     env["PATH_INFO"].should.equal "/foo"
     env["CONTENT_TYPE"].should.equal "multipart/form-data; boundary=AaB03x"
-    env["mock.postdata"].length.should.equal 206
+    # The gsub accounts for differences in YAMLs affect on the data.
+    env["mock.postdata"].gsub("\r", "").length.should.equal 206
   end
 
   should "behave valid according to the Rack spec" do

data/test/spec_request.rb

@@ -351,6 +351,19 @@ describe Rack::Request do
     req.cookies.should.equal({})
   end
 
+  should "always return the same hash object" do
+    req = Rack::Request.new \
+      Rack::MockRequest.env_for("", "HTTP_COOKIE" => "foo=bar;quux=h&m")
+    hash = req.cookies
+    req.env.delete("HTTP_COOKIE")
+    req.cookies.should.equal(hash)
+  end
+
+  should "raise any errors on every request" do
+    req = Rack::Request.new Rack::MockRequest.env_for("", "HTTP_COOKIE" => "foo=%")
+    2.times { proc { req.cookies }.should.raise(ArgumentError) }
+  end
+
   should "parse cookies according to RFC 2109" do
     req = Rack::Request.new \
       Rack::MockRequest.env_for('', 'HTTP_COOKIE' => 'foo=bar;foo=car')

data/test/spec_utils.rb

@@ -3,6 +3,14 @@ require 'rack/utils'
 require 'rack/mock'
 
 describe Rack::Utils do
+  def kcodeu
+    one8 = RUBY_VERSION.to_f < 1.9
+    default_kcode, $KCODE = $KCODE, 'U' if one8
+    yield
+  ensure
+    $KCODE = default_kcode if one8
+  end
+
   should "escape correctly" do
     Rack::Utils.escape("fo<o>bar").should.equal "fo%3Co%3Ebar"
     Rack::Utils.escape("a space").should.equal "a+space"
@@ -21,32 +29,28 @@ describe Rack::Utils do
 
   if RUBY_VERSION[/^\d+\.\d+/] == '1.8'
     should "escape correctly for multibyte characters if $KCODE is set to 'U'" do
-      default_kcode, $KCODE = $KCODE, 'U'
-
-      matz_name = "\xE3\x81\xBE\xE3\x81\xA4\xE3\x82\x82\xE3\x81\xA8".unpack("a*")[0] # Matsumoto
-      matz_name.force_encoding("UTF-8") if matz_name.respond_to? :force_encoding
-      Rack::Utils.escape(matz_name).should.equal '%E3%81%BE%E3%81%A4%E3%82%82%E3%81%A8'
-      matz_name_sep = "\xE3\x81\xBE\xE3\x81\xA4 \xE3\x82\x82\xE3\x81\xA8".unpack("a*")[0] # Matsu moto
-      matz_name_sep.force_encoding("UTF-8") if matz_name_sep.respond_to? :force_encoding
-      Rack::Utils.escape(matz_name_sep).should.equal '%E3%81%BE%E3%81%A4+%E3%82%82%E3%81%A8'
-
-      $KCODE = default_kcode
+      kcodeu do
+        matz_name = "\xE3\x81\xBE\xE3\x81\xA4\xE3\x82\x82\xE3\x81\xA8".unpack("a*")[0] # Matsumoto
+        matz_name.force_encoding("UTF-8") if matz_name.respond_to? :force_encoding
+        Rack::Utils.escape(matz_name).should.equal '%E3%81%BE%E3%81%A4%E3%82%82%E3%81%A8'
+        matz_name_sep = "\xE3\x81\xBE\xE3\x81\xA4 \xE3\x82\x82\xE3\x81\xA8".unpack("a*")[0] # Matsu moto
+        matz_name_sep.force_encoding("UTF-8") if matz_name_sep.respond_to? :force_encoding
+        Rack::Utils.escape(matz_name_sep).should.equal '%E3%81%BE%E3%81%A4+%E3%82%82%E3%81%A8'
+      end
     end
 
     should "unescape multibyte characters correctly if $KCODE is set to 'U'" do
-      default_kcode, $KCODE = $KCODE, 'U'
-      Rack::Utils.unescape('%E3%81%BE%E3%81%A4+%E3%82%82%E3%81%A8').should.equal(
+      kcodeu do
+        Rack::Utils.unescape('%E3%81%BE%E3%81%A4+%E3%82%82%E3%81%A8').should.equal(
         "\xE3\x81\xBE\xE3\x81\xA4 \xE3\x82\x82\xE3\x81\xA8".unpack("a*")[0])
-      $KCODE = default_kcode
+      end
     end
   end
 
   should "escape objects that responds to to_s" do
-    default_kcode, $KCODE = $KCODE, 'U'
-
-    Rack::Utils.escape(:id).should.equal "id"
-
-    $KCODE = default_kcode
+    kcodeu do
+      Rack::Utils.escape(:id).should.equal "id"
+    end
   end
 
   if "".respond_to?(:encode)
@@ -219,7 +223,7 @@ describe Rack::Utils do
       message.should.equal "value must be a Hash"
   end
 
-  should "should escape html entities [&><'\"/]" do
+  should "escape html entities [&><'\"/]" do
     Rack::Utils.escape_html("foo").should.equal "foo"
     Rack::Utils.escape_html("f&o").should.equal "f&amp;o"
     Rack::Utils.escape_html("f<o").should.equal "f&lt;o"
@@ -230,6 +234,27 @@ describe Rack::Utils do
     Rack::Utils.escape_html("<foo></foo>").should.equal "&lt;foo&gt;&lt;&#x2F;foo&gt;"
   end
 
+  should "escape html entities even on MRI when it's bugged" do
+    test_escape = lambda do
+      kcodeu do
+        Rack::Utils.escape_html("\300<").should.equal "\300&lt;"
+      end
+    end
+
+    if RUBY_VERSION.to_f < 1.9
+      test_escape.call
+    else
+      test_escape.should.raise(ArgumentError)
+    end
+  end
+
+  if "".respond_to?(:encode)
+    should "escape html entities in unicode strings" do
+      # the following will cause warnings if the regex is poorly encoded:
+      Rack::Utils.escape_html("☃").should.equal "☃"
+    end
+  end
+
   should "figure out which encodings are acceptable" do
     helper = lambda do |a, b|
       Rack::Request.new(Rack::MockRequest.env_for("", "HTTP_ACCEPT_ENCODING" => a))

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: rack
 version: !ruby/object:Gem::Version 
-  hash: 31
+  hash: 29
   prerelease: 
   segments: 
   - 1
   - 3
-  - 2
-  version: 1.3.2
+  - 3
+  version: 1.3.3
 platform: ruby
 authors: 
 - Christian Neukirchen
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-07-26 00:00:00 Z
+date: 2011-09-16 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: bacon
@@ -301,7 +301,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: rack
-rubygems_version: 1.8.5
+rubygems_version: 1.8.10
 signing_key: 
 specification_version: 3
 summary: a modular Ruby webserver interface