rack 1.6.1 → 1.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2ace023b19edf8bddd9a3124d7467475ae2b26c8
-  data.tar.gz: 83af4a55c057c7c69368aecfb591d9d14fbb39bc
+  metadata.gz: ab38bb5c60cd46486301f9260b5a573ee1f433f2
+  data.tar.gz: e17cf5cf671ebd4aa03826847d006be00c964c4a
 SHA512:
-  metadata.gz: a87031d7cbbd2fe42850cf3e85715efa780e67a3e536661f1c62fd6492df4126a83b2fc9f380c11383ec6f0d6eb219557a7bb215d3f0de048822e26c81e4d5b7
-  data.tar.gz: 07f4041dfa430a62a524ce7e02c66df531d5a29b87e44569706cbdf9cfe499e083232e86d6f519a48755f262cd562a307160b2f89ce6e9ffe339361e12eb59b3
+  metadata.gz: 71969e78c1454c8dcf6bd20e0fcb59f367d0e1a1b6ad32a512c866cb88f18ca1d98cb2074e704596a84fb91b64760e730dc590c1caf4b480ab5dae50994d776d
+  data.tar.gz: 5748ff056a909a1d1ee5ef717ccca1b04a5c6a076397cdefc05b23235a1f4fb3e8d3b833a65e3dbaa57c29efe7184eba7a69b47c59d5ca7d5e004cff228538e2

data/HISTORY.md

@@ -1,5 +1,8 @@
+Fri Jun 12 11:37:41 2015  Aaron Patterson <tenderlove@ruby-lang.org>
+
+	* Prevent extremely deep parameters from being parsed. CVE-2015-3225
+
 ### December 18th, Thirty sixth public release 1.6.0
-  - TODO
 
 ### February 7th, Thirty fifth public release 1.5.2
   - Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

data/lib/rack.rb

@@ -20,7 +20,7 @@ module Rack
 
   # Return the Rack release as a dotted string.
   def self.release
-    "1.6.1"
+    "1.6.2"
   end
   PATH_INFO      = 'PATH_INFO'.freeze
   REQUEST_METHOD = 'REQUEST_METHOD'.freeze

data/lib/rack/handler.rb

@@ -19,7 +19,7 @@ module Rack
       if klass = @handlers[server]
         klass.split("::").inject(Object) { |o, x| o.const_get(x) }
       else
-        const_get(server)
+        const_get(server, false)
       end
 
     rescue NameError => name_error

data/lib/rack/handler/webrick.rb

@@ -28,7 +28,6 @@ module Rack
 
         options[:BindAddress] = options.delete(:Host) || default_host
         options[:Port] ||= 8080
-        options[:OutputBufferSize] = 5
         @server = ::WEBrick::HTTPServer.new(options)
         @server.mount "/", Rack::Handler::WEBrick, app
         yield @server  if block_given?

data/lib/rack/mime.rb

@@ -614,6 +614,7 @@ module Rack
       ".wmx"       => "video/x-ms-wmx",
       ".wmz"       => "application/x-ms-wmz",
       ".woff"      => "application/font-woff",
+      ".woff2"     => "application/font-woff2",
       ".wpd"       => "application/vnd.wordperfect",
       ".wpl"       => "application/vnd.ms-wpl",
       ".wps"       => "application/vnd.ms-works",

data/lib/rack/static.rb

@@ -53,8 +53,8 @@ module Rack
   #  4) Regular Expressions / Regexp
   #     Provide a regular expression
   #     %r{\.(?:css|js)\z} => Matches files ending in .css or .js
-  #     /\.(?:eot|ttf|otf|woff|svg)\z/ => Matches files ending in
-  #       the most common web font formats (.eot, .ttf, .otf, .woff, .svg)
+  #     /\.(?:eot|ttf|otf|woff2|woff|svg)\z/ => Matches files ending in
+  #       the most common web font formats (.eot, .ttf, .otf, .woff2, .woff, .svg)
   #       Note: This Regexp is available as a shortcut, using the :fonts rule
   #
   #  5) Font Shortcut
@@ -132,7 +132,7 @@ module Rack
         when :all
           true
         when :fonts
-          path =~ /\.(?:ttf|otf|eot|woff|svg)\z/
+          path =~ /\.(?:ttf|otf|eot|woff2|woff|svg)\z/
         when String
           path = ::Rack::Utils.unescape(path)
           path.start_with?(rule) || path.start_with?('/' + rule)

data/lib/rack/utils.rb

@@ -61,6 +61,7 @@ module Rack
 
     class << self
       attr_accessor :key_space_limit
+      attr_accessor :param_depth_limit
       attr_accessor :multipart_part_limit
     end
 
@@ -68,6 +69,10 @@ module Rack
     # This helps prevent a rogue client from flooding a Request.
     self.key_space_limit = 65536
 
+    # Default depth at which the parameter parser will raise an exception for
+    # being too deep.  This helps prevent SystemStackErrors
+    self.param_depth_limit = 100
+
     # The maximum number of parts a request can contain. Accepting too many part
     # can lead to the server running out of file handles.
     # Set to `0` for no limit.
@@ -126,7 +131,9 @@ module Rack
     # normalize_params recursively expands parameters into structural types. If
     # the structural types represented by two different parameter names are in
     # conflict, a ParameterTypeError is raised.
-    def normalize_params(params, name, v = nil)
+    def normalize_params(params, name, v = nil, depth = Utils.param_depth_limit)
+      raise RangeError if depth <= 0
+
       name =~ %r(\A[\[\]]*([^\[\]]+)\]*)
       k = $1 || ''
       after = $' || ''
@@ -146,14 +153,14 @@ module Rack
         params[k] ||= []
         raise ParameterTypeError, "expected Array (got #{params[k].class.name}) for param `#{k}'" unless params[k].is_a?(Array)
         if params_hash_type?(params[k].last) && !params[k].last.key?(child_key)
-          normalize_params(params[k].last, child_key, v)
+          normalize_params(params[k].last, child_key, v, depth - 1)
         else
-          params[k] << normalize_params(params.class.new, child_key, v)
+          params[k] << normalize_params(params.class.new, child_key, v, depth - 1)
         end
       else
         params[k] ||= params.class.new
         raise ParameterTypeError, "expected Hash (got #{params[k].class.name}) for param `#{k}'" unless params_hash_type?(params[k])
-        params[k] = normalize_params(params[k], after, v)
+        params[k] = normalize_params(params[k], after, v, depth - 1)
       end
 
       return params

data/rack.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = "rack"
-  s.version         = "1.6.1"
+  s.version         = "1.6.2"
   s.platform        = Gem::Platform::RUBY
   s.summary         = "a modular Ruby webserver interface"
   s.license         = "MIT"

data/test/spec_handler.rb

@@ -23,6 +23,10 @@ describe Rack::Handler do
     lambda {
       Rack::Handler.get('boom')
     }.should.raise(LoadError)
+
+    lambda {
+      Rack::Handler.get('Object')
+    }.should.raise(LoadError)
   end
 
   should "get unregistered, but already required, handler by name" do

data/test/spec_utils.rb

@@ -134,6 +134,18 @@ describe Rack::Utils do
     }.should.not.raise
   end
 
+  should "raise an exception if the params are too deep" do
+    len = Rack::Utils.param_depth_limit
+
+    lambda {
+      Rack::Utils.parse_nested_query("foo#{"[a]" * len}=bar")
+    }.should.raise(RangeError)
+
+    lambda {
+      Rack::Utils.parse_nested_query("foo#{"[a]" * (len - 1)}=bar")
+    }.should.not.raise
+  end
+
   should "parse nested query strings correctly" do
     Rack::Utils.parse_nested_query("foo").
       should.equal "foo" => nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 1.6.1
+  version: 1.6.2
 platform: ruby
 authors:
 - Christian Neukirchen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-06 00:00:00.000000000 Z
+date: 2015-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bacon
@@ -254,7 +254,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: rack
-rubygems_version: 2.4.6
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: a modular Ruby webserver interface
@@ -308,4 +308,3 @@ test_files:
 - test/spec_utils.rb
 - test/spec_version.rb
 - test/spec_webrick.rb
-has_rdoc: