rack 2.1.3 → 2.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83025be71b5d57dbb184eb3d2364c727dad01c2214f683377dec5fdb3de0bc7d
-  data.tar.gz: c672e59748bb0b5412f017260168b7cd718f99c6bc7fc7ec2fd374d21b5dc7e3
+  metadata.gz: 3851dcf1bb18356cc36d8d390c8b2f7e9abde5a7068dac862246e8280a9d7c41
+  data.tar.gz: 5a5b9b318ba267f8ac3bd726048e6e826ff3feed3bb150252df91c7d038951cc
 SHA512:
-  metadata.gz: 9e3eecfe73f0dc2def1653c47d84dc9d044395ffed4a4021ac5dfd565267f214264c06efec8ef84fec3159a0e793acf6190ecf151280ab544cbb852eb32db168
-  data.tar.gz: 9c64bdf7f521ef19170025a24627f0e59ea3f18be605da7e623027928f153c1a3a71fc001695d52e99d153a3d50f11ef9b13c11223c3245bbf0a5cc3f10f2e57
+  metadata.gz: 7d071738226e954ce7bf0507422e41857bba7a10ceed70c22263b279cbbd19d362066a6ac62999a47212878f7e26e659e396c6c6ee51eb5dc4d5617a41859597
+  data.tar.gz: 2d0ff8ec9f7fe54a4c0d88fd4ae51424b506df4c9a15324830ea36961dda8e5327250637f8b0a4168d4f66e95c815d0f2cc773c56f5a70dcadf5d50491723614

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [2.1.4] - 2020-06-15
+
+- [CVE-2020-8184] When parsing cookies, only decode the value
+
+## [2.1.3] - 2020-05-12
+
+- [CVE-2020-8161] Use Dir.entries instead of Dir[glob] to prevent user-specified glob metacharacters
+-
 ## [2.1.2] - 2020-01-27
 
 - Fix multipart parser for some files to prevent denial of service ([@aiomaster](https://github.com/aiomaster))

data/lib/rack.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.1.3"
+  RELEASE = "2.1.4"
 
   # Return the Rack release as a dotted string.
   def self.release

data/lib/rack/directory.rb

@@ -112,6 +112,7 @@ table { width:100%%; }
       end
 
       Dir.entries(path).reject { |e| e.start_with?('.') }.sort.each do |node|
+        node = ::File.join path, node
         stat = stat(node)
         next unless stat
         basename = ::File.basename(node)

data/lib/rack/utils.rb

@@ -215,8 +215,12 @@ module Rack
       #   the Cookie header such that those with more specific Path attributes
       #   precede those with less specific.  Ordering with respect to other
       #   attributes (e.g., Domain) is unspecified.
-      cookies = parse_query(header, ';,') { |s| unescape(s) rescue s }
-      cookies.each_with_object({}) { |(k, v), hash| hash[k] = Array === v ? v.first : v }
+      return {} unless header
+      header.split(/[;,] */n).each_with_object({}) do |cookie, cookies|
+        next if cookie.empty?
+        key, value = cookie.split('=', 2)
+        cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
+      end
     end
     module_function :parse_cookies_header
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.1.3
+  version: 2.1.4
 platform: ruby
 authors:
 - Leah Neukirchen
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-05-12 00:00:00.000000000 Z
+date: 2020-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -170,7 +170,7 @@ metadata:
   homepage_uri: https://rack.github.io
   mailing_list_uri: https://groups.google.com/forum/#!forum/rack-devel
   source_code_uri: https://github.com/rack/rack
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -185,8 +185,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.0.pre1
+signing_key:
 specification_version: 4
 summary: a modular Ruby webserver interface
 test_files: []