summaryrefslogtreecommitdiff
path: root/lib/webrick
AgeCommit message (Collapse)Author
2017-12-24webrick 1.4.2normal
This release removes uses of Kernel#open to avoid unintended behaviors and make future auditing easier. [Misc #14216] 6 changes since 1.4.1: webrick: httpauth requires regular files webrick/httpservlet/cgi_runner.rb: remove unnecessary open webrick: WEBrick::Log requires path arg when given string webrick/httpservlet/*handler: use File.open webrick/httputils: note Kernel#open behavior webrick/httpservelet/cgi_runner: avoid IO#reopen on pathname git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61443 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservelet/cgi_runner: avoid IO#reopen on pathnamenormal
IO#reopen seems to behave strangely on Win32 based on the logs posted by Greg for [Bug #14420]. Lets try to fix the issue by using File.open explicitly (but not Kernel#open). * lib/webrick/httpservelet/cgi_runner: use File.open explicitly [Bug #14220] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61409 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httputils: note Kernel#open behaviornormal
I don't know who uses the load_mime_types method; but it is conceivable that a user would want to read the results of a command instead of reading a regular file to load MIME types. None of the WEBrick-related code in Ruby or default/bundled gems seems to rely on this method; but it is likely 3rd-party code does. * lib/webrick/httputils.rb (load_mime_types): note Kernel#open behavior [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61402 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservlet/*handler: use File.opennormal
This makes future code audits easier. None of these changes fix realistic remote code execution vulnerabilities because we stat(2) before attempting Kernel#open. * lib/webrick/httpservlet/erbhandler.rb (do_GET): use File.open * lib/webrick/httpservlet/filehandler.rb (do_GET): use File.open (make_partial_content): ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61401 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick: WEBrick::Log requires path arg when given stringnormal
Allowing a user to specify "| command" via Kernel#open is nonsensical since we never read from the resultant IO. * lib/webrick/log.rb (initialize): replace Kernel#open with File.open [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61400 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservlet/cgi_runner.rb: remove unnecessary opennormal
IO#reopen already takes string path names as well as IO objects (but not "| command" strings) This makes further auditing for inadvertant code execution easier. There's no actual bugfix or behavior change here, as no external data is passed to cgi_runner.rb. * lib/webrick/httpservlet/cgi_runner.rb: remove Kernel#open call [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61398 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick: httpauth requires regular filesnormal
Be sure we do not try to open a pipe to read from, since we care about mtime in all cases. * lib/webrick/httpauth/htdigest.rb: use File.open * lib/webrick/httpauth/htgroup.rb: ditto * lib/webrick/httpauth/htpasswd.rb: ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61397 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-18webrick 1.4.1 releasenormal
* lib/webrick/version.rb: bump version * lib/webrick/webrick.gemspec: support Ruby 2.3+ [Bug #14189] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61322 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-14webrick 1.4.0 releasenormal
* lib/webrick/version.rb: change VERSION to 1.4.0 * lib/webrick/webrick.gemspec: require_relative for version, update date and contact info [Feature #13173] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61266 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-13webrick: compile RE correctly for beginning and end matchnormal
Using ^ and $ in regexps means we can accidentally get fooled by "%0a" in HTTP request paths being decoded to newline characters. Use \A and \z to match beginning and end-of-string respectively, instead. Thanks to mame and hsbt for reporting. * lib/webrick/httpserver.rb (MountTable#compile): use \A and \z instead of ^ and $ * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $ * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61197 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-12Add uplevel keyword to Kernel#warn and use itshyouhei
If uplevel keyword is given, the warning message is prepended with caller file and line information and the string "warning: ". The use of the uplevel keyword makes Kernel#warn format output similar to how rb_warn formats output. This patch modifies net/ftp and net/imap to use Kernel#warn instead of $stderr.puts or $stderr.printf, since they are used for printing warnings. This makes lib/cgi/core and tempfile use $stderr.puts instead of warn for debug logging, since they are used for debug printing and not for warning. This does not modify bundler, rubygems, or rdoc, as those are maintained outside of ruby and probably wish to remain backwards compatible with older ruby versions. rb_warn_m code is originally from nobu, but I've changed it so that it only includes the path and lineno from uplevel (not the method), and also prepends the string "warning: ", to make it more similar to rb_warn. From: Jeremy Evans code@jeremyevans.net Signed-off-by: Urabe Shyouhei shyouhei@ruby-lang.org git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61155 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-12Ignore gemspec under the lib directory for documentation.hsbt
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61139 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-08webrick: allow shutdown after StartCallbacknormal
We must to ensure the @status ivar is set to :Running before running StartCallback, otherwise Webrick::Server#stop will not change the @status to :Shutdown properly. Note: I have not been able to reproduce the original issue but understood at least part of the problem and fixed it with this commit. However, the original reporter (Peak Xu) was still able to reproduce the problem on 1.9.2 p180 on Windows, so I'm not sure what else might be going on. Ruby threading and synchronization primitives have changed a lot since 1.9.2, so maybe that was fixed elsewhere. * lib/webrick/server.rb: call StartCallback sooner [Bug #4841] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61083 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-31webrick/httpresponse: minor cleanups to reduce memory usenormal
I never knew "format" was a global method alias for "sprintf"; so it was confusing to me. Normally, one would use "sprintf" since it's also available in many other languages, but Integer#to_s avoids parsing a format string so it's less bug-prone. Furthermore, favor string interpolation over String#<< since it is easier for the VM to optimize memory allocation (as in r60320). Interpolation also reduces method calls and memory overhead for inline method cache. Finally, ensure we clear all short-lived buffers for body responses. A similar change was made and measured for Net::* in r58840 showing a large memory reduction on some workloads. * webrick/httpresponse.rb (send_body_io): favor String#to_s, reduce method calls for String#<<, clear `buf' when done, avoid extra String#bytesize calls * (send_body_string): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60586 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-30webrick: support Proc objects as body responsesnormal
* lib/webrick/httpresponse.rb (send_body): call send_body_proc (send_body_proc): new method (class ChunkedWrapper): new class * test/webrick/test_httpresponse.rb (test_send_body_proc): new test (test_send_body_proc_chunked): ditto [Feature #855] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60584 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-18webrick: fix up r60172 and r60210normal
Thanks to MSP-Greg (Greg L) for helping with this. * lib/webrick/server.rb (start_thread): properly fix non-local return introduced in r60208 and r60210 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60211 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-18webrick: fix up r60172 and r60208normal
Thanks to MSP-Greg (Greg L) for helping with this. * lib/webrick/server.rb (start_thread): fix non-local return introduced in r60208 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60210 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-18webrick: fix up r60172 and revert r60189normal
Thanks to MSP-Greg (Greg L) for helping with this. * lib/webrick/server.rb (start_thread): ignore ECONNRESET, ECONNABORTED, EPROTO, and EINVAL on TLS negotiation errors the same way they were ignored before r60172 in the accept_client method of the main acceptor thread. [Bug #14013] [Bug #14005] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60208 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-16webrick: fix up r60172normal
By making the socket non-blocking in r60172, TLS/SSL negotiation via the SSL_accept function must handle non-blocking sockets properly and retry on SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE. OpenSSL::SSL::SSLSocket#accept cannot do that properly with a non-blocking socket, so it must use non-blocking logic of OpenSSL::SSL::SSLSocket#accept_nonblock. Thanks to MSP-Greg (Greg L) for finding this. * lib/webrick/server.rb (start_thread): use SSL_accept properly with non-blocking socket. [Bug #14013] [Bug #14005] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60189 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-12webrick: do not hang acceptor on slow TLS connectionsnormal
OpenSSL::SSL::SSLSocket#accept may block indefinitely on clients which negotiate the TCP connection, but fail (or are slow) to negotiate the subsequent TLS handshake. This prevents the multi-threaded WEBrick server from accepting other connections. Since the TLS handshake (via OpenSSL::SSL::SSLSocket#accept) consists of normal read/write traffic over TCP, handle it in the per-client thread, instead. Furthermore, using non-blocking accept() is useful for non-TLS sockets anyways because spurious wakeups are possible from select(2). * lib/webrick/server.rb (accept_client): use TCPServer#accept_nonblock and remove OpenSSL::SSL::SSLSocket#accept call * lib/webrick/server.rb (start_thread): call OpenSSL::SSL::SSLSocket#accept * test/webrick/test_ssl_server.rb (test_slow_connect): new test [ruby-core:83221] [Bug #14005] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60172 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-09webrick: avoid needless wakeup from IO.selectnormal
Since r51231 ("webrick/server.rb: stop immediately"), there is no need to poll on the @status change every two seconds. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60144 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-08Remove unnecessary `require 'thread'`kazu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60139 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-05webrick: avoid unnecessary IO#sync= callnormal
Sockets and pipes are always created with FMODE_SYNC flag already set (otherwise many things would be broken). * lib/webrick/server.rb (accept_client): remove unnecessary IO#sync= call git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60123 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-05Fixed invalid gemspec.hsbt
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60119 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-10-05Followed up [ruby-core:83093]. Update gemspec attributes.hsbt
Added metadata for rubygems.org. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60117 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-09-19webrick: handle EAGAIN/EWOULDBLOCK on proxy connectionsnormal
* lib/webrick/httpproxy.rb (do_CONNECT): high-level IO methods [ruby-core:82861] [Bug #12130] Patch by: Keisuke NISHI git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59965 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-09-19Define the MIME type for JSON in WEBrick::HTTPUtils::DefaultMimeTypes.hsbt
[Feature #10798][ruby-core:67879] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59960 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-09-15To use github url for gemspec.hsbt
[Bug #13906][ruby-core:82817] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59931 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-09-14lib/webrick/log.rb: sanitize any type of logsmame
It had failed to sanitize some type of exception messages. Reported and patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59897 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-07-18webrick: fix SNI supportnormal
* lib/webrick/https.rb: check ssl context of virtual host. * lib/webrick/ssl.rb: ensure to return ssl context. * test/webrick/test_https.rb: test returned cert is correct. [Feature #13729][ruby-dev:50173] Author: Tietew <tietew@gmail.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59351 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-07-07webrick: add Server Name Indication (SNI)normal
* lib/webrick/https.rb: servername_cb implementation. * lib/webrick/ssl.rb: abstract servername_cb. * test/webrick/test_https.rb: test. [ruby-dev:50165] [Feature #13729] Author: Tietew <tietew@gmail.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59281 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-06-19Make string literal to frozen object on gemspec of defulte gems.hsbt
Added following gemspecs. * extensions: date, dbm, etc, fiddle, gdbm, sdbm, stringio, strscan, zlib * pure ruby libraries: cmath, csv, fileutils, scanf, webrick psych and rdoc is out of scope of this commit. I will merge after upstream was change to `frozen_string_literal: true`. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59115 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-05-01Merge gemspec from ruby/webrick.hsbt
* Bump version to 1.4.0.beta1. Because https://rubygems.org/gems/webrick is already reserved old version of webrick. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58529 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-04-25Import gemspechsbt
Import gemspec and test file from ruby/webrick. * webrick.gemspec: Update files and dependency for standalone gem. * test/webrick/utils.rb: Added explicitly loading of EnvUtil for test suite without ruby core test suite. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58473 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-02-07Fix a required ruby version on gemspec of gemified libraries.hsbt
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57561 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-01-31Initial commit for gem release of webrick.hsbt
[Feature #13173] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57481 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-12-07Delay Utils.getservername until needed.shugo
There is no need to call Utils.getservername when the :ServerName option is specified, so delay Utils.getservername until needed to avoid unnecessary DNS lookups. [ruby-core:78492] [Bug #13007] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57014 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-23webrick/server: use symbol procnormal
Symbol proc is less code and avoids confusion from variable naming. * lib/webrick/server.rb (shutdown): use symbol proc git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56889 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-22Use `&.` and `||=` instead of if guardsnobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56875 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-22IOError does not happenkazu
* IOError does not happen even if another thread closes io * Use symbol proc git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56874 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-22webrick/server: simplify Daemon.startnormal
Process.daemon exists since Ruby 1.9.1 and does most of what we need. * lib/webrick/server.rb (Daemon.start): simplify [Misc #12937] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56869 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-11-21lib/*: remove closed checksnormal
Follow r56795. Since Ruby 2.2, calling #close on a closed socket no longer raises exceptions. * lib/cgi/session.rb (update): remove closed? check * lib/net/http.rb (finish, transport_request): ditto * lib/net/imap.rb (disconnect): ditto * lib/net/pop.rb (do_start, do_finish): ditto * lib/net/smtp.rb (do_start, do_finish): ditto * lib/open3.rb (popen_run, pipeline_run): ditto * lib/pstore.rb (transaction): ditto * lib/shell/process-controller.rb (sfork): * lib/tempfile (_close, call, Tempfile.create): ditto * lib/webrick/httpauth/htdigest.rb (flush): ditto * lib/webrick/httpauth/htpasswd.rb (flush): ditto * lib/webrick/server.rb (start_thread, cleanup_shutdown_pipe): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56865 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-10-14webrick: use monotonic clock for timeoutsnormal
The monotonic clock is immune to system time changes and a better option for implementing timing comparisons. * lib/webrick/utils.rb (TimeoutHandler): use monotonic clock (watch): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56417 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-09-27* lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]naruse
* lib/webrick/cookie.rb (parse): ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56262 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-08-30Use qualified namesnobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56037 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-08-12* lib/webrick/config.rb (WEBrick::Config::General):naruse
disable reverse lookup by default. [ruby-core:45514] [Feature #6559] Socket.do_not_reverse_lookup is true by default but WEBrick overwrote it. patch by Eric Hodel [ruby-core:45527] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55881 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-07-22webrick: filter out HTTP_PROXY for CGIHandlernormal
* lib/webrick/httpservlet/cgihandler.rb (do_GET): delete HTTP_PROXY * test/webrick/test_cgi.rb (test_cgi_env): new test * test/webrick/webrick.cgi (do_GET): new endpoint to dump env [ruby-core:76511] [Bug #12610] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55731 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-06-21Multiple values X-Forwarded-Proto in webricknobu
* lib/webrick/httprequest.rb (setup_forwarded_info): Use the first value in X-Forwarded-Proto, if header contains multiple comma separated values. Some middlewares may add these values to the list, not replacing. [Fix GH-1386] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55484 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-05-07* lib/webrick/ssl.rb: Accept string value for SSLCertName. It is usedhsbt
to invoke ssl server with command line. [fix GH-1329] Patch by @kerlin * test/webrick/test_ssl_server.rb: Added test for GH-1329 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54941 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2016-04-22* lib/webrick/ssl.rb: Support to add SSLCiphers option.hsbt
[fix GH-1321] Patch by @rhadoo git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54669 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 23:46:53 +0000