rack 2.1.1 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c636b399e2635a9c09098c5b9c7bc47488b2184d0283d21853616862bbadacd
-  data.tar.gz: fc4e151fe86e0752616e3e42b01f7f730250ab6cc55dc1bbe3452ed7bc92b507
+  metadata.gz: cf07380f1952c2d3ae911f2dba3cc6b03cc9270874488cbda132651f4618e928
+  data.tar.gz: d040738bea53e28625c2d9a7f4fc55e098e63890b9cf539bdacf9873b0e7a690
 SHA512:
-  metadata.gz: 416fca4689a96df477d6b90978470c34c68facfa7ce1ee48cc1956f47e9f7379d906ae661b1c78ff14ff565c19f16ca28e5dcbfef18e9f87c36f7fb5d781d54f
-  data.tar.gz: 8d400ae00dae63dc5afcb84aef13598b95892dce2d9bd3d2662da64c22dc97e28d30b125692c71547b0d41e44fb1628d1eba9cf5e42a834502353c7730acd872
+  metadata.gz: 3ab7bed6e3272ac7441312cc407726ddc9389730289799cff762933fb464e3c162c004c1dcc40f95fcbed05c803010bffb2ce88726c751e7540d405428f09749
+  data.tar.gz: ccff9e0ea2fc4a09d549cfc4c290b2aff48cd267f323c709cc3afc6803f62763ec208dcc9a55663d7743782fc4ce1ff507e709031c261714a2dc4b04102fb498

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [2.1.2] - 2020-01-27
+
+- Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))
+- Fix `Rack::Builder#use` with keyword arguments ([@kamipo](https://github.com/kamipo))
+- Skip deflating in Rack::Deflater if Content-Length is 0 ([@jeremyevans](https://github.com/jeremyevans))
+- Remove `SessionHash#transform_keys`, no longer needed ([@pavel](https://github.com/pavel))
+- Add to_hash to wrap Hash and Session classes ([@oleh-demyanyuk](https://github.com/oleh-demyanyuk))
+- Handle case where session id key is requested but missing ([@jeremyevans](https://github.com/jeremyevans))
+
 ## [2.1.1] - 2020-01-12
 
 - Remove `Rack::Chunked` from `Rack::Server` default middleware. ([#1475](https://github.com/rack/rack/pull/1475), [@ioquatix](https://github.com/ioquatix))

data/lib/rack.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.1.1"
+  RELEASE = "2.1.2"
 
   # Return the Rack release as a dotted string.
   def self.release

data/lib/rack/builder.rb

@@ -101,6 +101,7 @@ module Rack
       end
       @use << proc { |app| middleware.new(app, *args, &block) }
     end
+    ruby2_keywords(:use) if respond_to?(:ruby2_keywords, true)
 
     # Takes an argument that is an object that responds to #call and returns a Rack response.
     # The simplest form of this is a lambda object:

data/lib/rack/deflater.rb

@@ -124,6 +124,10 @@ module Rack
       # Skip if @condition lambda is given and evaluates to false
       return false if @condition && !@condition.call(env, status, headers, body)
 
+      # No point in compressing empty body, also handles usage with
+      # Rack::Sendfile.
+      return false if headers[CONTENT_LENGTH] == '0'
+
       true
     end
   end

data/lib/rack/multipart/parser.rb

@@ -185,7 +185,7 @@ module Rack
         @collector = Collector.new tempfile
 
         @sbuf = StringScanner.new("".dup)
-        @body_regex = /(.*?)(#{EOL})?#{Regexp.quote(@boundary)}(#{EOL}|--)/m
+        @body_regex = /(?:#{EOL})?#{Regexp.quote(@boundary)}(?:#{EOL}|--)/m
         @rx_max_size = EOL.size + @boundary.bytesize + [EOL.size, '--'.size].max
         @head_regex = /(.*?#{EOL})#{EOL}/m
       end
@@ -268,8 +268,8 @@ module Rack
       end
 
       def handle_mime_body
-        if @sbuf.check_until(@body_regex) # check but do not advance the pointer yet
-          body = @sbuf[1]
+        if (body_with_boundary = @sbuf.check_until(@body_regex)) # check but do not advance the pointer yet
+          body = body_with_boundary.sub(/#{@body_regex}\z/m, '') # remove the boundary from the string
           @collector.on_mime_body @mime_index, body
           @sbuf.pos += body.length + 2 # skip \r\n after the content
           @state = :CONSUME_TOKEN

data/lib/rack/session/abstract/id.rb

@@ -56,14 +56,6 @@ module Rack
           end
         } unless {}.respond_to?(:transform_keys)
 
-        def transform_keys(&block)
-          hash = dup
-          each do |key, value|
-            hash[block.call(key)] = value
-          end
-          hash
-        end
-
         include Enumerable
         attr_writer :id
 
@@ -209,7 +201,7 @@ module Rack
         end
 
         def stringify_keys(other)
-          other.transform_keys(&:to_s)
+          other.to_hash.transform_keys(&:to_s)
         end
       end
 
@@ -460,7 +452,7 @@ module Rack
           def [](key)
             if key == "session_id"
               load_for_read!
-              id.public_id
+              id.public_id if id
             else
               super
             end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.1.1
+  version: 2.1.2
 platform: ruby
 authors:
 - Leah Neukirchen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-11 00:00:00.000000000 Z
+date: 2020-01-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest