summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-03-28webrick: prevent response splitting and header injectionnormal
Original patch by tenderlove (with minor style adjustments). * lib/webrick/httpresponse.rb (send_header): call check_header (check_header): raise on embedded CRLF in header value * test/webrick/test_httpresponse.rb (test_prevent_response_splitting_headers): new test * (test_prevent_response_splitting_cookie_headers): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62968 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28io.c: IO#write without args returns 0normal
This is consistent with other implementations of .write in openssl and stringio. * io.c (io_write_m): return 0 on argc == 0 [ruby-core:86285] [Bug #14338] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62967 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpproxy: stream request and response bodiesnormal
Reading entire request or response bodies into memory can lead to trivial denial-of-service attacks. Introduce Fibers in both cases to allow streaming. WEBrick::HTTPRequest gains a new body_reader method to prepare itself as a source for IO.copy_stream. This allows the WEBrick::HTTPRequest object to be used as the Net::HTTPGenericRequest#body_stream= arg for Net::HTTP. For HTTP proxy response bodies, we also use a Fiber to to make the HTTP request and read the response body. * lib/webrick/httprequest.rb (body_reader): new method (readpartial): ditto * lib/webrick/httpproxy.rb (perform_proxy_request): use Fiber to stream response body (do_GET, do_HEAD): adjust call (do_POST): adjust call and supply body_reader * test/webrick/test_httprequest.rb (test_chunked): test for IO.copy_stream compatibility * test/webrick/test_httpproxy.rb (test_big_bodies): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62966 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpauth/digestauth: stream req.bodynormal
WARNING! WARNING! WARNING! LIKELY BROKEN CHANGE Pass a proc to WEBrick::HTTPRequest#body to avoid reading a potentially large request body into memory during authentication. WARNING! this will break apps completely which want to do something with the body besides calculating the MD5 digest of it. Also, keep in mind that probably nobody uses "auth-int". Servers such as Apache, lighttpd, nginx don't seem to support it; nor does curl when using POST/PUT bodies; and we didn't have tests for it until now... * lib/webrick/httpauth/digestauth.rb (_authenticate): stream req.body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62965 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: add test for Digest auth-intnormal
No changes to the actual code, this is a new test for a feature for which no tests existed. I don't understand the Digest authentication code well at all, but this is necessary for the subsequent change. * test/webrick/test_httpauth.rb (test_digest_auth_int): new test (credentials_for_request): support bodies with POST git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62964 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: use InputBufferSize for chunked requestsnormal
While WEBrick::HTTPRequest#body provides a Proc interface for streaming large request bodies, clients must not force the server to use an excessively large chunk size. * lib/webrick/httprequest.rb (read_chunk_size): limit each read and block.call to :InputBufferSize in config. * test/webrick/test_httpserver.rb (test_big_chunks): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62963 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: raise correct exceptionnormal
"BadRequest" alone does not resolve correctly, it is in the HTTPStatus namespace. * lib/webrick/httprequest.rb (read_chunked): use correct exception * test/webrick/test_httpserver.rb (test_eof_in_chunk): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62962 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpservlet/cgihandler: reduce memory usenormal
WEBrick::HTTPRequest#body can be passed a block to process the body in chunks. Use this feature to avoid building a giant string in memory. * lib/webrick/httpservlet/cgihandler.rb (do_GET): avoid reading entire request body into memory (do_POST is aliased to do_GET, so it handles bodies) git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62961 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: limit request headers sizenormal
We use the same 112 KB limit started (AFAIK) by Mongrel, Thin, and Puma to prevent malicious users from using up all the memory with a single request. This also limits the damage done by excessive ranges in multipart Range: requests. Due to the way we rely on IO#gets and the desire to keep the code simple, the actual maximum header may be 4093 bytes larger than 112 KB, but we're splitting hairs at that point. * lib/webrick/httprequest.rb: define MAX_HEADER_LENGTH (read_header): raise when headers exceed max length git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62960 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: use IO.copy_stream for multipart responsenormal
Use the new Proc response body feature to generate a multipart range response dynamically. We use a flat array to minimize object overhead as much as possible; as many ranges may fit into an HTTP request header. * lib/webrick/httpservlet/filehandler.rb (multipart_body): new method (make_partial_content): use multipart_body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62959 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpresponse: make ChunkedWrapper copy_stream-compatiblenormal
The .write method needs to return the number of bytes written to avoid confusing IO.copy_stream. * lib/webrick/httpresponse.rb (ChunkedWrapper#write): return bytes written (ChunkedWrapper#<<): return self git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62958 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: quiet warning for multi-part rangesnormal
Content-Length is ignored by WEBrick::HTTPResponse even if we calculate it, so instead we chunk responses to HTTP/1.1 clients and terminate HTTP/1.0 connections. * lib/webrick/httpservlet/filehandler.rb (make_partial_content): quiet warning git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62957 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28test/webrick/test_filehandler.rb: stricter multipart range testnormal
We need to ensure we generate compatibile output in the face of future changes * test/webrick/test_filehandler.rb (test_make_partial_content): check response body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62956 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: use IO.copy_stream for single range responsenormal
This is also compatible with range responses generated by Rack::File (tested with rack 2.0.3). * lib/webrick/httpresponse.rb (send_body_io): use Content-Range * lib/webrick/httpservlet/filehandler.rb (make_partial_content): use File object for the single range case * test/webrick/test_filehandler.rb (get_res_body): use send_body to test result git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62955 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpresponse: IO.copy_stream for regular filesnormal
Remove the redundant _send_file method since its functionality is unnecessary with IO.copy_stream. IO.copy_stream also allows the use of sendfile under some OSes to speed up copies to non-TLS sockets. Testing with "curl >/dev/null" and "ruby -run -e httpd" to read a 1G file over Linux loopback reveals a reduction from around ~0.770 to ~0.490 seconds on the client side. * lib/webrick/httpresponse.rb (send_body_io): use IO.copy_stream (_send_file): remove [Feature #14237] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62954 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: favor .write over << methodnormal
This will make the next change to use IO.copy_stream easier-to-read. When we can drop Ruby 2.4 support in a few years, this will allow us to use writev(2) with multiple arguments for headers and chunked responses. * lib/webrick/cgi.rb (write): new wrapper method lib/webrick/httpresponse.rb: (send_header): use socket.write (send_body_io): ditto (send_body_string): ditto (send_body_proc): ditto (_write_data): ditto (ChunkedWrapper#write): ditto (_send_file): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62953 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28win32/file.c: relative path with drive letternobu
* win32/file.c (IS_ABSOLUTE_PATH_P): home directory should not be a relative path regardless a drive letter. PathIsRelativeW returns FALSE on such path. [ruby-core:86356] [Bug #14638] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62952 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28* 2018-03-28svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62936 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28fix regexp introduced at recent RDoc update (r62924).ko1
* lib/rdoc/text.rb: should escape `-` character. Sometimes test fails if `$VERBOSE = 1` with the following warning: > text.rb:172: warning: character class has duplicated range: ... git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62935 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-27thread_sync.c: avoid reaching across stacks of dead threadsnormal
rb_ensure is insufficient cleanup for fork and we must reinitialize all waitqueues in the child process. Unfortunately this increases the footprint of ConditionVariable, Queue and SizedQueue by 8 bytes on 32-bit (16 bytes on 64-bit). [ruby-core:86316] [Bug #14634] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62934 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-27configure.ac: string literal concatenationnobu
* configure.ac: bail out if string literal concatenation is not available, as it is used everywhere now. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62933 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-27ruby.c: exit by --versionnobu
* ruby.c (usage): stated exiting by `--version` option with nothing done. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62932 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Update to ruby/spec@a585ec3eregon
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62931 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26* properties.svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62930 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Update to ruby/mspec@8b54bf3eregon
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62929 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26* 2018-03-27svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62928 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26ruby.c: fix --verbose description in usagenobu
* ruby.c (usage): fix the description of `--verbose` option, which does not print the version number unlike `-v` option. [ruby-core:86307] [Bug #14633] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62927 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Fix test errorkazu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62926 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26* remove trailing spaces.svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62925 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Merge RDoc 6.0.3 from upstream.hsbt
It fixed the several bugs that was found after RDoc 6 releasing. From: SHIBATA Hiroshi <hsbt@ruby-lang.org> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62924 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26bigdecimal.c: fix missing argumentnobu
* ext/bigdecimal/bigdecimal.c (rb_rational_num, rb_rational_den): fix missing argc argument for old ruby. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62923 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26* 2018-03-26svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62922 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Update Complex#infinite? documenationnobu
to state what it really does. [Fix GH-1848] From: Christian Bruckmayer <cbruckmayer@suse.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62921 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-26Update Complex#finite? documentationnobu
to state what it really does. [Fix GH-1848] From: Christian Bruckmayer <cbruckmayer@suse.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62920 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-25assertions for r62914nobu
* test/ruby/test_keyword.rb (test_splat_hash): assertion on mandatory and rest arguments. r62914 is not only for optional argument. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62919 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-25vm_args.c: warn splat to varnobu
* vm_args.c (setup_parameters_complex): [EXPERIMENTAL] warn when splat keyword arguments is passed as a single ordinary argument, not as a keyword rest argument. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62914 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-25* 2018-03-25svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62913 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-25extmk.rb: get rid of shadowing outer local variablenobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62912 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-24configure.ac: named blocksnobu
* configure.ac: turned section block comments into named blocks. http://c16e.com/1603281120/ git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-24compile.c: split add_insn_infonobu
* compile.c (add_insn_info, add_adjust_info): split for each list->type, to remove unnecessary repeated conditions and casts. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62908 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-24* 2018-03-24svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62907 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-24compile.c: suppress missing-noreturnnobu
* compile.c (add_insn_info): move return statement to suppress missing-noreturn warning. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62906 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-23parse.y: k_else in bodystmtnobu
* parse.y (bodystmt): expand opt_else to show the error message at the right place. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62902 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-23parse.y: else without rescuenobu
* parse.y (bodystmt): [EXPERIMENTAL] make `else` without `rescue` a syntax error. [DevelopersMeeting20180315Japan] https://bugs.ruby-lang.org/projects/ruby/wiki/DevelopersMeeting20180315Japan https://docs.google.com/document/d/1RT0ijSo8uJ4Awn3CEvuYkjH0TVeXSYgeAFNmVGYC3ak/edit# > * do-else-end > https://twitter.com/joker1007/status/974173396006129664 > https://twitter.com/joker1007/status/974173641347756032 > https://twitter.com/joker1007/status/974176512554369027 > Will be SyntaxError in 2.6-preview2 > All of begin/do/def (experimental) git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62901 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22* 2018-03-23svn
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62900 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22test_exception.rb: assertions with Exception.to_tty?nobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62899 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22sample/timeout.rb: Remove unnecessary increment [ci skip]kazu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62898 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22set UTF-8 if given URI string is ASCIInaruse
Now URI is normally UTF-8, and US-ASCII URI string is considered as escaped a UTF-8 string. https://github.com/rails/rails/issues/32294 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62897 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22error.c: full_message optionsnobu
* error.c (exc_full_message): add highlight: and reverse: keyword options. [Bug #14324] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62894 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-22Factor out get_reg_grapheme_clusternaruse
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62893 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-19 07:00:07 +0000