kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Fix integer overflow

Browse source 
Make use of the check in rb_alloc_tmp_buffer2.

    https://hackerone.com/reports/1328463

    When parsing cookies, only decode the values

    Bump version

    Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
    Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
This commit is contained in:
nagachika 2021-11-24 20:12:15 +09:00
parent 02dfd5a710
commit 3fb7d2cadc
5 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ext/cgi/escape/escape.c
View file

@ -36,7 +36,8 @@ static VALUE
optimized_escape_html(VALUE str)
{
VALUE vbuf;
char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
const char *cstr = RSTRING_PTR(str);
const char *end = cstr + RSTRING_LEN(str);

2
lib/cgi.rb
View file

@ -288,7 +288,7 @@
#
class CGI
VERSION = "0.2.0"
VERSION = "0.2.1"
end
require 'cgi/core'

1
lib/cgi/cookie.rb
View file

@ -159,7 +159,6 @@ class CGI
raw_cookie.split(/;\s?/).each do |pairs|
name, values = pairs.split('=',2)
next unless name and values
name = CGI.unescape(name)
values ||= ""
values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
if cookies.has_key?(name)

5
test/cgi/test_cgi_cookie.rb
View file

@ -101,6 +101,11 @@ class CGICookieTest < Test::Unit::TestCase
end
end
def test_cgi_cookie_parse_not_decode_name
cookie_str = "%66oo=baz;foo=bar"
cookies = CGI::Cookie.parse(cookie_str)
assert_equal({"%66oo" => ["baz"], "foo" => ["bar"]}, cookies)
end
def test_cgi_cookie_arrayinterface
cookie = CGI::Cookie.new('name1', 'a', 'b', 'c')

2
version.h
View file

@ -12,7 +12,7 @@
# define RUBY_VERSION_MINOR RUBY_API_VERSION_MINOR
#define RUBY_VERSION_TEENY 3
#define RUBY_RELEASE_DATE RUBY_RELEASE_YEAR_STR"-"RUBY_RELEASE_MONTH_STR"-"RUBY_RELEASE_DAY_STR
#define RUBY_PATCHLEVEL 156
#define RUBY_PATCHLEVEL 157
#define RUBY_RELEASE_YEAR 2021
#define RUBY_RELEASE_MONTH 11