thin 1.8.0 → 1.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 285d7efc73ff2e6e29a8789706c605cc2a2b5a1d25313a53d72954dd5a8adbe7
-  data.tar.gz: 24642b42692477ba60cb63cb0ffa49dcf63cc0634708a349d8fac94d08989b74
+  metadata.gz: f0681c9fc49913fca3b6478faa3ce96a449e3926e09d5986fca0b1ace57d6fc7
+  data.tar.gz: 44f1f7fd3b3e176939178745df3116286b2b32cd5c01d0d6fe19bf4637e5aac7
 SHA512:
-  metadata.gz: ab7de3338f8d8694ed44a04cf785e78a0ce85de874d7bde4d96c6801b1e85190a3cbd33d8fe16a32aedc09eab9f1caad4a37ce51dc5997c32b5550da6d2fcffc
-  data.tar.gz: 19c45bc3a6f403daffe6a6c66b89bca01c597edb5b8c6ada110834c52fac0f639746f9b51ce5a3ca42c8f2fa013c929929b64b3737819ce83e5dff257e8a328a
+  metadata.gz: 6e476bb431b484071fff7240da1d17265ad07571951697ca9d023e457268911b2d3c37451236aabf6ff57b59eb9d30c51479bd3ef3f39aadbf6ce830f5c212a8
+  data.tar.gz: '094627fc3d7da6e51c64059987625c9d5c1bbeec5b4766343b41aa00a1ebb769ea89ed7cf14ba9c6805450ffc82b92d7abd1ae7b4138c37ff7054d26fe337e69'

data/CHANGELOG

@@ -1,3 +1,9 @@
+== 1.8.1 Infinite Smoothie
+ * Fix possible HTTP Response Splitting
+
+== 1.8.0 Possessed Pickle
+ * Many things
+
 == 1.7.2 Bachmanity
  * Add config support for ssl_version and ssl_cipher_list [frameworked]
 

data/lib/thin/headers.rb

@@ -1,9 +1,14 @@
 module Thin
+  # Raised when an header is not valid
+  # and the server can not process it.
+  class InvalidHeader < StandardError; end
+
   # Store HTTP header name-value pairs direcly to a string
   # and allow duplicated entries on some names.
   class Headers
     HEADER_FORMAT      = "%s: %s\r\n".freeze
     ALLOWED_DUPLICATES = %w(set-cookie set-cookie2 warning www-authenticate).freeze
+    CR_OR_LF           = /[\r\n]/.freeze
     
     def initialize
       @sent = {}
@@ -22,6 +27,8 @@ module Thin
                   value.httpdate
                 when NilClass
                   return
+                when CR_OR_LF
+                  raise InvalidHeader, "Header contains CR or LF"
                 else
                   value.to_s
                 end

data/lib/thin/version.rb

@@ -6,11 +6,11 @@ module Thin
   module VERSION #:nodoc:
     MAJOR    = 1
     MINOR    = 8
-    TINY     = 0
+    TINY     = 1
     
     STRING   = [MAJOR, MINOR, TINY].join('.')
     
-    CODENAME = "Possessed Pickle".freeze
+    CODENAME = "Infinite Smoothie".freeze
     
     RACK     = [1, 0].freeze # Rack protocol version
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: thin
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.8.1
 platform: ruby
 authors:
 - Marc-Andre Cournoyer
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-13 00:00:00.000000000 Z
+date: 2021-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -70,7 +70,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.9
-description:
+description: 
 email: macournoyer@gmail.com
 executables:
 - thin
@@ -134,7 +134,7 @@ licenses:
 metadata:
   source_code_uri: https://github.com/macournoyer/thin
   changelog_uri: https://github.com/macournoyer/thin/blob/master/CHANGELOG
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -149,8 +149,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key:
+rubygems_version: 3.0.3
+signing_key: 
 specification_version: 4
 summary: A thin and fast web server
 test_files: []