rack 2.2.6 → 2.2.6.1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of rack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/lib/rack/multipart.rb +2 -2
- data/lib/rack/version.rb +1 -1
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3954ca2ddaa60814965ba95a0b8b9c3b38f6dc6348d343f0b950f3b2780748fa
|
|
4
|
+
data.tar.gz: a9df63f5080312265894683c21ccaae362c85233112c8d34f1b1919b8c46e5b6
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 03cae09c56cf3e3033bd5e46eecb114931b65ce5d1cfe843a6514c55c19cb518ec7e52444bdb7976932e4647b7fb66be2100062b5ba816b65c17079139382986
|
|
7
|
+
data.tar.gz: 1b86e1c18186276473daedac322a237e48fdd51b885ae291800eb1c5500c97f468dfeb7f5a0ac89540f8e2d654e6c414cfa0bdea0fb8cccc84259387386c6f40
|
data/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,12 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
|
|
4
4
|
|
|
5
|
+
## [2.2.6.1] - 2022-01-17
|
|
6
|
+
|
|
7
|
+
- [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
|
|
8
|
+
- [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
|
|
9
|
+
- [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)
|
|
10
|
+
|
|
5
11
|
## [2.2.6] - 2022-01-17
|
|
6
12
|
|
|
7
13
|
- Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot))
|
data/lib/rack/multipart.rb
CHANGED
|
@@ -18,10 +18,10 @@ module Rack
|
|
|
18
18
|
VALUE = /"(?:\\"|[^"])*"|#{TOKEN}/
|
|
19
19
|
BROKEN = /^#{CONDISP}.*;\s*filename=(#{VALUE})/i
|
|
20
20
|
MULTIPART_CONTENT_TYPE = /Content-Type: (.*)#{EOL}/ni
|
|
21
|
-
MULTIPART_CONTENT_DISPOSITION = /Content-Disposition
|
|
21
|
+
MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:[^:]*;\s*name=(#{VALUE})/ni
|
|
22
22
|
MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
|
|
23
23
|
# Updated definitions from RFC 2231
|
|
24
|
-
ATTRIBUTE_CHAR = %r{[^ \
|
|
24
|
+
ATTRIBUTE_CHAR = %r{[^ \x00-\x1f\x7f)(><@,;:\\"/\[\]?='*%]}
|
|
25
25
|
ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
|
|
26
26
|
SECTION = /\*[0-9]+/
|
|
27
27
|
REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/
|
data/lib/rack/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rack
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.2.6
|
|
4
|
+
version: 2.2.6.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Leah Neukirchen
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2023-01-
|
|
11
|
+
date: 2023-01-17 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: minitest
|
|
@@ -184,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
184
184
|
- !ruby/object:Gem::Version
|
|
185
185
|
version: '0'
|
|
186
186
|
requirements: []
|
|
187
|
-
rubygems_version: 3.
|
|
187
|
+
rubygems_version: 3.1.6
|
|
188
188
|
signing_key:
|
|
189
189
|
specification_version: 4
|
|
190
190
|
summary: A modular Ruby webserver interface.
|