sinatra 2.2.2 → 2.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6b8730578692f8db32fb574c1cf27c820afae370f0de28de6e3b96523130fd8
-  data.tar.gz: 22a5f5e701f27316173b91346823e0b82219627fb01008477434ca2a41a1bf5d
+  metadata.gz: 1e7c0f0444061d6ca90cf2956cb78a750065625116500dafde2da94ec133c1c4
+  data.tar.gz: 03ae4a16304045e5a52a8f98e07922ab0c5351889a1106942a22d89445dfcef4
 SHA512:
-  metadata.gz: 436f31687f5d18ca518e55c30ce2223dd585bd2366ed03236bbf3f90a1047ed4cac669755a13e10c83f6554fc07c8dcb48492b831df722c26f0015cce0499f30
-  data.tar.gz: d535d71adf2d75f9f2d1e29f3bd9b4cc6e60f34e77f9a38d9b65e8494b5fe372c77142ddd161730388966c557b9e89b21eb5a0c9300e3761ff00e528c0ac3cb9
+  metadata.gz: 41c6dc03102ac2ca8735d30a4cd1646d803be5a7fbd9cae0702cb3b41419e6b17451707498749baf0c06d2002b075e3f9d06a1eef1d4a4ee35dee95c73dd2bc3
+  data.tar.gz: 4c7ebcf714cb7f73f8fa5b179f41f978994126c90c775d4a3a4aa944c6146ece45cb9c797b130ab8a2575e177fd7128b8c5da7f6cdb440a18a2110cc7aca215e

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2.2.3 / 2022-11-25
+
+* Fix: Escape filename in the Content-Disposition header. [#1841](https://github.com/sinatra/sinatra/pull/1841) by Kunpei Sakai
+
+* Fix: fixed ReDoS for Rack::Protection::IPSpoofing. [#1823](https://github.com/sinatra/sinatra/pull/1823) by @ooooooo-q
+
+## 2.2.2 / 2022-07-23
+
+* Update mustermann dependency to version 2.
+
 ## 2.2.1 / 2022-07-15
 
 * Fix JRuby regression by using ruby2_keywords for delegation. [#1750](https://github.com/sinatra/sinatra/pull/1750) by Patrik Ragnarsson
@@ -6,6 +16,8 @@
 
 ## 2.2.0 / 2022-02-15
 
+* Breaking change: Add #select, #reject and #compact methods to Sinatra::IndifferentHash. If hash keys need to be converted to symbols, call #to_h to get a Hash instance first. #1711 by Olivier Bellone
+
 * Handle EOFError raised by Rack and return Bad Request 400 status. [#1743](https://github.com/sinatra/sinatra/pull/1743) by tamazon
 
 * Update README.es.md with removal of Thin. [#1630](https://github.com/sinatra/sinatra/pull/1630) by Espartaco Palma
@@ -48,9 +60,6 @@
 
 * Remove unnecessary `test_files` from the gemspec. [#1712](https://github.com/sinatra/sinatra/pull/1712) by Masataka Pocke Kuwabara
 
-* Add `#select`, `#reject` and `#compact` methods to `Sinatra::IndifferentHash`. [#1711](https://github.com/sinatra/sinatra/pull/1711) by Olivier Bellone
-
-
 ### CI
 
 * Use latest JRuby 9.2.16.0 on CI. [#1682](https://github.com/sinatra/sinatra/pull/1682) by Olle Jonsson

data/Gemfile

@@ -23,7 +23,7 @@ gem "twitter-text", "1.14.7"
 
 if RUBY_ENGINE == 'jruby'
   gem 'nokogiri', '!= 1.5.0'
-  gem 'puma'
+  gem 'puma', '~> 5'
 end
 
 if RUBY_ENGINE == 'jruby' || RUBY_ENGINE == 'ruby'
@@ -38,14 +38,13 @@ if RUBY_ENGINE == "ruby"
   gem 'bluecloth'
   gem 'rdiscount'
   gem 'RedCloth'
-  gem 'puma'
+  gem 'puma', '~> 5'
   gem 'yajl-ruby'
   gem 'nokogiri'
   gem 'rainbows'
   gem 'eventmachine'
   gem 'slim', '~> 2.0'
   gem 'coffee-script', '>= 2.0'
-  gem 'rdoc'
   gem 'kramdown'
   gem 'maruku'
   gem 'creole'

data/VERSION

@@ -1 +1 @@
-2.2.2
+2.2.4

data/lib/sinatra/base.rb

@@ -381,16 +381,23 @@ module Sinatra
       response['Content-Type'] = mime_type
     end
 
+    # https://html.spec.whatwg.org/#multipart-form-data
+    MULTIPART_FORM_DATA_REPLACEMENT_TABLE = {
+      '"'  => '%22',
+      "\r" => '%0D',
+      "\n" => '%0A'
+    }.freeze
+
     # Set the Content-Disposition to "attachment" with the specified filename,
     # instructing the user agents to prompt to save.
     def attachment(filename = nil, disposition = :attachment)
       response['Content-Disposition'] = disposition.to_s.dup
-      if filename
-        params = '; filename="%s"' % File.basename(filename)
-        response['Content-Disposition'] << params
-        ext = File.extname(filename)
-        content_type(ext) unless response['Content-Type'] or ext.empty?
-      end
+      return unless filename
+
+      params = format('; filename="%s"', File.basename(filename).gsub(/["\r\n]/, MULTIPART_FORM_DATA_REPLACEMENT_TABLE))
+      response['Content-Disposition'] << params
+      ext = File.extname(filename)
+      content_type(ext) unless response['Content-Type'] || ext.empty?
     end
 
     # Use the contents of the file at +path+ as the response body.
@@ -1230,6 +1237,10 @@ module Sinatra
 
       attr_reader :routes, :filters, :templates, :errors
 
+      def callers_to_ignore
+        CALLERS_TO_IGNORE
+      end
+
       # Removes all routes, filters, middleware and extension hooks from the
       # current class (not routes/filters/... defined by its superclass).
       def reset!
@@ -1779,7 +1790,7 @@ module Sinatra
       def cleaned_caller(keep = 3)
         caller(1).
           map!    { |line| line.split(/:(?=\d|in )/, 3)[0,keep] }.
-          reject { |file, *_| CALLERS_TO_IGNORE.any? { |pattern| file =~ pattern } }
+          reject { |file, *_| callers_to_ignore.any? { |pattern| file =~ pattern } }
       end
     end
 

data/lib/sinatra/version.rb

@@ -1,3 +1,3 @@
 module Sinatra
-  VERSION = '2.2.1'
+  VERSION = '2.2.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sinatra
 version: !ruby/object:Gem::Version
-  version: 2.2.2
+  version: 2.2.4
 platform: ruby
 authors:
 - Blake Mizerany
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-07-23 00:00:00.000000000 Z
+date: 2022-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -47,14 +47,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.2
+        version: 2.2.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.2
+        version: 2.2.4
 - !ruby/object:Gem::Dependency
   name: mustermann
   requirement: !ruby/object:Gem::Requirement
@@ -145,7 +145,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
+rubyforge_project:
+rubygems_version: 2.7.6.3
 signing_key:
 specification_version: 4
 summary: Classy web-development dressed in a DSL