rack 3.0.13 → 3.0.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c864d1b0b86355469b17edefb5ac47e659ae4e47d156070615f12ba012117ce
-  data.tar.gz: 82fd6ccbc59081e2483e8bf541d669c3c1be5caa36418306b1009d0a2c396fff
+  metadata.gz: aba215a5282440e26123d6d89cbd7f69c423bb5a2deb8948cdda64db357e70bd
+  data.tar.gz: 63f6ba8e4cfe56ab88e3ef08c9d57104b2ef5bed04a90024e01ad702bfd3521e
 SHA512:
-  metadata.gz: f1425831596a8893831d295947e6cb33936616397aaf106855a2f30410b3b8b590d04a405d7de5211ff8a64608abd5a7fa9b02e1fce0b182bff37a0f9a57f095
-  data.tar.gz: a84716c10271fd19d6d3ae199424358615252136dcab72baf87ccf8ed9384c1b59a66a316d016937d28c555b556afd6d81084b3dfd75d5832ad14b05edb190c1
+  metadata.gz: 8f4c65b5ebf1b508a389ecc8a9863c23eb486441eb0067b3d97c8fc715c8c9cb5df570cdb887e7aee84256baa92a027a42bd71757d3eb208d5818c201848ca29
+  data.tar.gz: 62af3b727ae2110984d2b58699483a40be233bd766f2f35d7dec07c56369ad942b72866a768068390e46b39e42c4e51e0461573f02cd9166cf8e43ceabb59284

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.0.14] - 2025-03-11
+
+### Security
+
+- [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
+
 ## [3.0.13] - 2025-03-04
 
 ### Security
@@ -194,6 +200,12 @@ All notable changes to this project will be documented in this file. For info on
 - Fix multipart filename generation for filenames that contain spaces. Encode spaces as "%20" instead of "+" which will be decoded properly by the multipart parser. ([#1736](https://github.com/rack/rack/pull/1645), [@muirdm](https://github.com/muirdm))
 - `Rack::Request#scheme` returns `ws` or `wss` when one of the `X-Forwarded-Scheme` / `X-Forwarded-Proto` headers is set to `ws` or `wss`, respectively. ([#1730](https://github.com/rack/rack/issues/1730), [@erwanst](https://github.com/erwanst))
 
+## [2.2.13] - 2025-03-11
+
+### Security
+
+- [CVE-2025-27610](https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v) Local file inclusion in `Rack::Static`.
+
 ## [2.2.12] - 2025-03-04
 
 ### Security

data/lib/rack/static.rb

@@ -124,8 +124,9 @@ module Rack
 
     def call(env)
       path = env[PATH_INFO]
+      actual_path = Utils.clean_path_info(Utils.unescape_path(path))
 
-      if can_serve(path)
+      if can_serve(actual_path)
         if overwrite_file_path(path)
           env[PATH_INFO] = (add_index_root?(path) ? path + @index : @urls[path])
         elsif @gzip && env['HTTP_ACCEPT_ENCODING'] && /\bgzip\b/.match?(env['HTTP_ACCEPT_ENCODING'])

data/lib/rack/version.rb

@@ -25,7 +25,7 @@ module Rack
     VERSION
   end
 
-  RELEASE = "3.0.13"
+  RELEASE = "3.0.14"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 3.0.13
+  version: 3.0.14
 platform: ruby
 authors:
 - Leah Neukirchen
 bindir: bin
 cert_chain: []
-date: 2025-03-04 00:00:00.000000000 Z
+date: 2025-03-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest