rack 1.3.3 → 1.3.4

data/README.rdoc

@@ -361,6 +361,15 @@ run on port 11211) and memcache-client installed.
   * Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine
   * Rack::ConditionalGet handles broken If-Modified-Since helpers
 
+* September 16, 2011: Eighteenth public release 1.2.4
+  * Fix a bug with MRI regex engine to prevent XSS by malformed unicode
+
+* October 1, 2011: Nineteenth public release 1.3.4
+  * Backport security fix from 1.9.3, also fixes some roundtrip issues in URI
+  * Small documentation update
+  * Fix an issue where BodyProxy could cause an infinite recursion
+  * Add some supporting files for travis-ci
+
 == Contact
 
 Please post bugs, suggestions and patches to

data/lib/rack/backports/uri/common_192.rb

@@ -0,0 +1,54 @@
+# :stopdoc:
+
+# Stolen from ruby core's uri/common.rb @32618ba to fix DoS issues in 1.9.2
+#
+# https://github.com/ruby/ruby/blob/32618ba7438a2247042bba9b5d85b5d49070f5e5/lib/uri/common.rb
+#
+# Issue:
+# http://redmine.ruby-lang.org/issues/5149
+#
+# Relevant Fixes:
+# https://github.com/ruby/ruby/commit/b5f91deee04aa6ccbe07c23c8222b937c22a799b
+# https://github.com/ruby/ruby/commit/93177c1e5c3906abf14472ae0b905d8b5c72ce1b
+#
+# This should probably be removed once there is a Ruby 1.9.2 patch level that
+# includes this fix.
+
+require 'uri/common'
+
+module URI
+  def self.decode_www_form(str, enc=Encoding::UTF_8)
+    return [] if str.empty?
+    unless /\A#{WFKV_}=#{WFKV_}(?:[;&]#{WFKV_}=#{WFKV_})*\z/o =~ str
+      raise ArgumentError, "invalid data of application/x-www-form-urlencoded (#{str})"
+    end
+    ary = []
+    $&.scan(/([^=;&]+)=([^;&]*)/) do
+      ary << [decode_www_form_component($1, enc), decode_www_form_component($2, enc)]
+    end
+    ary
+  end
+
+  def self.decode_www_form_component(str, enc=Encoding::UTF_8)
+    if TBLDECWWWCOMP_.empty?
+      tbl = {}
+      256.times do |i|
+        h, l = i>>4, i&15
+        tbl['%%%X%X' % [h, l]] = i.chr
+        tbl['%%%x%X' % [h, l]] = i.chr
+        tbl['%%%X%x' % [h, l]] = i.chr
+        tbl['%%%x%x' % [h, l]] = i.chr
+      end
+      tbl['+'] = ' '
+      begin
+        TBLDECWWWCOMP_.replace(tbl)
+        TBLDECWWWCOMP_.freeze
+      rescue
+      end
+    end
+    raise ArgumentError, "invalid %-encoding (#{str})" unless /\A[^%]*(?:%\h\h[^%]*)*\z/ =~ str
+    str.gsub(/\+|%\h\h/, TBLDECWWWCOMP_).force_encoding(enc)
+  end
+
+  WFKV_ = '(?:[^%#=;&]*(?:%\h\h[^%#=;&]*)*)' # :nodoc:
+end

data/lib/rack/body_proxy.rb

@@ -9,13 +9,10 @@ module Rack
     end
 
     def close
-      raise IOError, "closed stream" if @closed
-      begin
-        @body.close if @body.respond_to? :close
-      ensure
-        @block.call
-        @closed = true
-      end
+      return if @closed
+      @closed = true
+      @body.close if @body.respond_to? :close
+      @block.call
     end
 
     def closed?

data/lib/rack/mime.rb

@@ -28,6 +28,9 @@ module Rack
     #     list = WEBrick::HTTPUtils.load_mime_types('/etc/mime.types')
     #     Rack::Mime::MIME_TYPES.merge!(list)
     #
+    # N.B. On Ubuntu the mime.types file does not include the leading period, so
+    # users may need to modify the data before merging into the hash.
+    #
     # To add the list mongrel provides, use:
     #
     #     require 'mongrel/handlers'

data/lib/rack/utils.rb

@@ -6,9 +6,10 @@ require 'rack/multipart'
 
 major, minor, patch = RUBY_VERSION.split('.').map { |v| v.to_i }
 
-if (major == 1 && minor < 9) || (major == 1 && minor == 9 && patch < 2)
-  # pull in backports
-  require 'rack/backports/uri/common'
+if major == 1 && minor < 9
+  require 'rack/backports/uri/common_18'
+elsif major == 1 && minor == 9 && patch < 3
+  require 'rack/backports/uri/common_192'
 else
   require 'uri/common'
 end

data/rack.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = "rack"
-  s.version         = "1.3.3"
+  s.version         = "1.3.4"
   s.platform        = Gem::Platform::RUBY
   s.summary         = "a modular Ruby webserver interface"
 
@@ -32,6 +32,6 @@ EOF
 
   s.add_development_dependency 'fcgi'
   s.add_development_dependency 'memcache-client'
-  s.add_development_dependency 'mongrel'
+  s.add_development_dependency 'mongrel', '>= 1.2.0.pre2'
   s.add_development_dependency 'thin'
 end

data/test/spec_body_proxy.rb

@@ -35,9 +35,14 @@ describe Rack::BodyProxy do
   should 'not close more than one time' do
     count = 0
     proxy = Rack::BodyProxy.new([]) { count += 1; raise "Block invoked more than 1 time!" if count > 1 }
+    2.times { proxy.close }
+    count.should.equal 1
+  end
+
+  should 'be closed when the callback is triggered' do
+    closed = false
+    proxy = Rack::BodyProxy.new([]) { closed = proxy.closed? }
     proxy.close
-    lambda {
-      proxy.close
-    }.should.raise(IOError)
+    closed.should.equal true
   end
 end

data/test/spec_utils.rb

@@ -58,6 +58,16 @@ describe Rack::Utils do
       Rack::Utils.escape("ø".encode("ISO-8859-1")).should.equal "%F8"
     end
   end
+  
+  should "not hang on escaping long strings that end in % (http://redmine.ruby-lang.org/issues/5149)" do
+    lambda {
+      timeout(1) do
+        lambda {
+          URI.decode_www_form_component "A string that causes catastrophic backtracking as it gets longer %"
+        }.should.raise(ArgumentError)
+      end
+    }.should.not.raise(Timeout::Error)
+  end
 
   should "escape path spaces with %20" do
     Rack::Utils.escape_path("foo bar").should.equal  "foo%20bar"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: rack
 version: !ruby/object:Gem::Version 
-  hash: 29
+  hash: 19
   prerelease: 
   segments: 
   - 1
   - 3
-  - 3
-  version: 1.3.3
+  - 4
+  version: 1.3.4
 platform: ruby
 authors: 
 - Christian Neukirchen
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-16 00:00:00 Z
+date: 2011-10-01 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: bacon
@@ -81,10 +81,14 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
+        hash: 1923831981
         segments: 
+        - 1
+        - 2
         - 0
-        version: "0"
+        - pre
+        - 2
+        version: 1.2.0.pre2
   type: :development
   version_requirements: *id005
 - !ruby/object:Gem::Dependency 
@@ -131,7 +135,8 @@ files:
 - lib/rack/auth/digest/nonce.rb
 - lib/rack/auth/digest/params.rb
 - lib/rack/auth/digest/request.rb
-- lib/rack/backports/uri/common.rb
+- lib/rack/backports/uri/common_18.rb
+- lib/rack/backports/uri/common_192.rb
 - lib/rack/body_proxy.rb
 - lib/rack/builder.rb
 - lib/rack/cascade.rb