puma--puma

mirror of https://github.com/puma/puma.git synced 2022-11-09 13:48:40 -05:00

History

evanweaver ef5d6ada18 update summary git-svn-id: svn+ssh://rubyforge.org/var/svn/mongrel/trunk@553 19e92222-5c0b-0410-8929-a290d50e31e9		2007-08-14 20:01:11 +00:00
..
lib	let's just be quiet about the gem if things are ok	2007-08-14 03:53:11 +00:00
test	some comments	2007-08-13 21:02:13 +00:00
CHANGELOG	changelog	2007-08-13 21:56:45 +00:00
LICENSE	initial import of cgi_multipart_eof_fix	2007-08-13 20:14:18 +00:00
Manifest	some comments	2007-08-13 21:02:13 +00:00
Rakefile	update summary	2007-08-14 20:01:11 +00:00
README	actually, mongrel_rails does the require	2007-08-13 22:25:22 +00:00

README

cgi_multipart_eof_fix

Fix an exploitable bug in CGI multipart parsing.

== License

Copyright 2006, 2007 Cloudburst, LLC. Portions copyright 2006 Jeremy Kemper, Jamis Buck, Zed A. Shaw, and Yukihiro Matsumoto, and used with permission. See the included LICENSE file. 

== Description

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.

This is fix is cumulative with previous CGI multipart vulnerability fixes; see version 1.0.0 of the gem by Jamis Buck et. al.

== Installation

  sudo gem install cgi_multipart_eof_fix

== Scope

* Affected: standalone CGI, Mongrel, WEBrick
* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
* Unknown: mod_ruby

This library will not modify versions of Ruby greater than 1.8.5.

== Usage

Run the included test to verify that the patch works as intended. Then, <tt>require</tt> the gem in every affected application, as follows:

  require 'rubygems' 
  require 'cgi_multipart_eof_fix'
  
Currently <tt>mongrel_rails</tt> requires this gem automatically. However, Mongrel may change in the future.

== Further resources

* http://blog.evanweaver.com/pages/code#cgi_multipart_eof_fix
* http://rubyforge.org/mailman/listinfo/mongrel-users
* http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/