kotovalexarian-likes-github/puma--puma
1
0
Fork 0
mirror of https://github.com/puma/puma.git synced 2022-11-09 13:48:40 -05:00
Code Releases Activity
puma--puma/projects/cgi_multipart_eof_fix
History
evanweaver ed4144807a 3-series version number 
git-svn-id: svn+ssh://rubyforge.org/var/svn/mongrel/trunk@611 19e92222-5c0b-0410-8929-a290d50e31e9
2007-09-24 02:16:41 +00:00
..
lib let's just be quiet about the gem if things are ok 2007-08-14 03:53:11 +00:00
test some comments 2007-08-13 21:02:13 +00:00
CHANGELOG 3-series version number 2007-09-24 02:16:41 +00:00
LICENSE initial import of cgi_multipart_eof_fix 2007-08-13 20:14:18 +00:00
Manifest some comments 2007-08-13 21:02:13 +00:00
Rakefile don't assign 2007-09-23 01:19:03 +00:00
README simplify readme structure 2007-08-22 10:38:43 +00:00

README 

cgi_multipart_eof_fix

Fix an exploitable bug in CGI multipart parsing.

== License

Copyright 2006, 2007 Cloudburst, LLC. Portions copyright 2006 Jeremy Kemper, Jamis Buck, Zed A. Shaw, and Yukihiro Matsumoto, and used with permission. See the included LICENSE file. 

== Description

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.

* Affected application servers: standalone CGI, Mongrel, WEBrick
* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
* Unknown: mod_ruby

This fix will not modify versions of Ruby greater than 1.8.5, and is cumulative with previous CGI multipart vulnerability fixes.

== Usage

Install the gem:
  sudo gem install cgi_multipart_eof_fix

Run the included test to verify that the patch works as intended. Then, <tt>require</tt> the gem in every affected application, as follows:

  require 'rubygems' 
  require 'cgi_multipart_eof_fix'
  
Currently <tt>mongrel_rails</tt> requires this gem automatically. However, Mongrel may change in the future.

== Reporting problems

* http://rubyforge.org/tracker/?group_id=1306

== Further resources

* http://rubyforge.org/mailman/listinfo/mongrel-users
* http://blog.evanweaver.com/articles/2006/12/05/cgi-rb-vulnerability-hotfix
* http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/