summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2019-08-28merger revision(s): f308ab2131ee675000926540cbb8c13c91dc3be5usa
Remove jquery.js git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67793 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-08-28merge revision(s) 989e8ad322afdfa3aa06e74b89fc42aef42895d0:usa
Remove debug print [ci skip] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67790 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-08-27Update rdoc version from 6.0.1 to 6.0.1.1.usa
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67779 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-08-26merge revision(s) ↵usa
f91879a7b548284c93743168acfd11e3d2aeefac,9557069299ac3b96691040a541afa65761a724ad: [Backport #15992] handle_interrupt to defend monitor state [Bug #15992] If an exception is raised from another thread for example Timeout and this thread is just after `mon_exit`'s `@mon_owner = nil`, the exception breaks the state of MonitorMixin. To prevent that situation, it need to block interruption in mon_enter and mon_exit. Avoid creating Hash objects per each mon_synchronize call (#2393) git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67774 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-08-26merge revision(s) 5bab1304af25a843728dbcd2f3594913740aecb0: [Backport #15847]usa
fix visibility of SecureRandom.gen_random Aliasing a method preserves its visibility. These aliases turn formerly-public methods into private. Should make them public again. [Bug #15847] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67762 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-08-26merge revision(s) d118c84b0b9110462e479487ffaf175a75e5718e: [Backport #15199]usa
Fix IO#scanf on pipes on Windows IO.seek on a pipe on Windows raises Errno::EINVAL instead of Errno::ESPIPE. Fixes Ruby Bug #15199 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67754 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-07-31merge revision(s) 67563: [Backport #15769]usa
Support SNI (Reapplying r67488) This fixes connecting using TLS 1.3 to imap.gmail.com [Fix GH-2077] [Feature #15594] From: Marc-Antoine Perennou <Marc-Antoine@Perennou.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67717 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-03-13merge revision(s) 66909: [Backport #15555]nagachika
tmpdir.rb: permission of user given directory * lib/tmpdir.rb (Dir.mktmpdir): check if the permission of the parent directory only when using the default temporary directory, and no check against user given directory. the security is the user's responsibility in that case. [ruby-core:91216] [Bug #15555] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67241 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-03-12merge revision(s) 64234,64252: [Backport #15219]nagachika
net/http, net/ftp: fix session resumption with TLS 1.3 When TLS 1.3 is in use, the session ticket may not have been sent yet even though a handshake has finished. Also, the ticket could change if multiple session ticket messages are sent by the server. Use SSLContext#session_new_cb instead of calling SSLSocket#session immediately after a handshake. This way also works with earlier protocol versions. net/http, net/ftp: skip SSL/TLS session resumption tests Due to a bug in OpenSSL 1.1.0h[1] (it's only in this specific version; it was introduced just before the release and is already fixed in their stable branch), the callback set by SSLContext#session_new_cb= does not get called for clients, making net/http and net/ftp not attempt session resumption. Let's disable the affected test cases for now. Another option would be to fallback to using SSLSocket#session as we did before r64234. But since only a single version is affected and hopefully a new stable version containing the fix will be released in near future, I chose not to add such workaround code to lib/. [1] https://github.com/openssl/openssl/pull/5967 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67237 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-03-12Merge RubyGems 2.7.6.2 patch [Bug #15643]nagachika
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67235 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-03-12Merge RubyGems 2.7.6.1 patch [Bug #15637]nagachika
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67234 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-01-20merge revision(s) 66401: [Backport #15412]nagachika
Move autoload to toplevel So that classes which uses Net::HTTP with https can use OpenSSL namespace for example exception classes like OpenSSL::SSL::SSLError. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@66877 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2019-01-07merge revision(s) 62671: [Backport #14571]nagachika
resolv.rb: close socket * lib/resolv.rb (UnconnectedUDP#lazy_initialize): store new sockets before binding, so the sockets get closed when the requester is closing. * lib/resolv.rb (ConnectedUDP#lazy_initialize): ditto. * lib/resolv.rb (UnconnectedUDP#close): synchronize to get rid of race condition. * lib/resolv.rb (ConnectedUDP#close): ditto. [ruby-core:85901] [Bug #14571] From: quixoten (Devin Christensen) <quixoten@gmail.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@66748 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-10-09merge revision(s) 62007,62024: [Backport #13069]nagachika
mkmf.rb: ignore linker warnings * lib/mkmf.rb (try_ldflags): ignore linker warnings. they cause unexpected failures on OpenBSD. [ruby-core:78827] [Bug #13069] mkmf.rb: werror on mswin * lib/mkmf.rb (MakeMakefile#try_ldflags): enable warning checking on mswin, link.exe warns -l options but does not fail. [Bug #13069] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64979 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-08-18merge revision(s) 62099: [Backport #14416]nagachika
net/pop: make modified strings mutable Thanks to Michael Zimmerman for the bug report * lib/net/pop.rb: make modified strings mutable [ruby-core:85210] [Bug #14416] * test/net/pop/test_pop.rb: new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64443 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-08-18merge revision(s) 63698: [Backport #14856]nagachika
lib/drb/extservm.rb (service): do not return `false' invoke_service_command may set entries in @servers to `false', making it incompatible with the intended use of the safe navigation operator. This caused occasional DRb test failures, but they were hidden with automatic retry. [ruby-core:87524] [Bug #14856] Fixes: r53111 ("use safe navigation operator") commit 059c9c1cf371e049c7481c78b76e9620da52757f [GH-1142] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64437 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-08-18merge revision(s) 63512,63514: [Backport #14790]nagachika
time.rb: fix parsing time zone in iso8601 * lib/time.rb (Time.xmlschema): a colon in time zone designator can be omitted. [ruby-core:87277] [Bug #14790] time.rb: fix parsing time zone in iso8601 * lib/time.rb (Time.xmlschema): the minute in time zone designator can be omitted together with the preceding colon. [ruby-core:87277] [Bug #14790] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64431 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-08-17merge revision(s) 63396: [Backport #14750]nagachika
net/imap: Fix ArgumentError in send_string_data Thanks to ShockwaveNN (Pavel Lobashov) for reporting the bug. [ruby-core:86990] [Bug #14750] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@64420 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28revert r62985 (r62966 in trunk)naruse
It breaks test-all git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@63025 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28merge revision(s) 63008:naruse
get rid of test error/failure on Windows introduced at r62955 * lib/webrick/httpresponse.rb (send_body_io): use seek if NotImplementedError is raised in IO.copy_stream with offset. * lib/webrick/httpservlet/filehandler.rb (multipart_body): ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@63011 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28fix r62970 as r62990naruse
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@63007 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28merge revision(s) 62953-62959:naruse
win32/file.c: relative path with drive letter * win32/file.c (IS_ABSOLUTE_PATH_P): home directory should not be a relative path regardless a drive letter. PathIsRelativeW returns FALSE on such path. [ruby-core:86356] [Bug #14638] ------------------------------------------------------------------------ r62953 | normal | 2018-03-28 17:05:46 +0900 (Wed, 28 Mar 2018) | 15 lines webrick: favor .write over << method This will make the next change to use IO.copy_stream easier-to-read. When we can drop Ruby 2.4 support in a few years, this will allow us to use writev(2) with multiple arguments for headers and chunked responses. * lib/webrick/cgi.rb (write): new wrapper method lib/webrick/httpresponse.rb: (send_header): use socket.write (send_body_io): ditto (send_body_string): ditto (send_body_proc): ditto (_write_data): ditto (ChunkedWrapper#write): ditto (_send_file): ditto ------------------------------------------------------------------------ r62954 | normal | 2018-03-28 17:05:52 +0900 (Wed, 28 Mar 2018) | 14 lines webrick/httpresponse: IO.copy_stream for regular files Remove the redundant _send_file method since its functionality is unnecessary with IO.copy_stream. IO.copy_stream also allows the use of sendfile under some OSes to speed up copies to non-TLS sockets. Testing with "curl >/dev/null" and "ruby -run -e httpd" to read a 1G file over Linux loopback reveals a reduction from around ~0.770 to ~0.490 seconds on the client side. * lib/webrick/httpresponse.rb (send_body_io): use IO.copy_stream (_send_file): remove [Feature #14237] ------------------------------------------------------------------------ r62955 | normal | 2018-03-28 17:05:57 +0900 (Wed, 28 Mar 2018) | 10 lines webrick: use IO.copy_stream for single range response This is also compatible with range responses generated by Rack::File (tested with rack 2.0.3). * lib/webrick/httpresponse.rb (send_body_io): use Content-Range * lib/webrick/httpservlet/filehandler.rb (make_partial_content): use File object for the single range case * test/webrick/test_filehandler.rb (get_res_body): use send_body to test result ------------------------------------------------------------------------ r62956 | normal | 2018-03-28 17:06:02 +0900 (Wed, 28 Mar 2018) | 7 lines test/webrick/test_filehandler.rb: stricter multipart range test We need to ensure we generate compatibile output in the face of future changes * test/webrick/test_filehandler.rb (test_make_partial_content): check response body ------------------------------------------------------------------------ r62957 | normal | 2018-03-28 17:06:08 +0900 (Wed, 28 Mar 2018) | 8 lines webrick: quiet warning for multi-part ranges Content-Length is ignored by WEBrick::HTTPResponse even if we calculate it, so instead we chunk responses to HTTP/1.1 clients and terminate HTTP/1.0 connections. * lib/webrick/httpservlet/filehandler.rb (make_partial_content): quiet warning ------------------------------------------------------------------------ r62958 | normal | 2018-03-28 17:06:13 +0900 (Wed, 28 Mar 2018) | 7 lines webrick/httpresponse: make ChunkedWrapper copy_stream-compatible The .write method needs to return the number of bytes written to avoid confusing IO.copy_stream. * lib/webrick/httpresponse.rb (ChunkedWrapper#write): return bytes written (ChunkedWrapper#<<): return self ------------------------------------------------------------------------ r62959 | normal | 2018-03-28 17:06:18 +0900 (Wed, 28 Mar 2018) | 9 lines webrick: use IO.copy_stream for multipart response Use the new Proc response body feature to generate a multipart range response dynamically. We use a flat array to minimize object overhead as much as possible; as many ranges may fit into an HTTP request header. * lib/webrick/httpservlet/filehandler.rb (multipart_body): new method (make_partial_content): use multipart_body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@63006 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick: prevent response splitting and header injectionnaruse
Original patch by tenderlove (with minor style adjustments). * lib/webrick/httpresponse.rb (send_header): call check_header (check_header): raise on embedded CRLF in header value * test/webrick/test_httpresponse.rb (test_prevent_response_splitting_headers): new test * (test_prevent_response_splitting_cookie_headers): ditto git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62986 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpproxy: stream request and response bodiesnaruse
Reading entire request or response bodies into memory can lead to trivial denial-of-service attacks. Introduce Fibers in both cases to allow streaming. WEBrick::HTTPRequest gains a new body_reader method to prepare itself as a source for IO.copy_stream. This allows the WEBrick::HTTPRequest object to be used as the Net::HTTPGenericRequest#body_stream= arg for Net::HTTP. For HTTP proxy response bodies, we also use a Fiber to to make the HTTP request and read the response body. * lib/webrick/httprequest.rb (body_reader): new method (readpartial): ditto * lib/webrick/httpproxy.rb (perform_proxy_request): use Fiber to stream response body (do_GET, do_HEAD): adjust call (do_POST): adjust call and supply body_reader * test/webrick/test_httprequest.rb (test_chunked): test for IO.copy_stream compatibility * test/webrick/test_httpproxy.rb (test_big_bodies): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62985 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpauth/digestauth: stream req.bodynaruse
WARNING! WARNING! WARNING! LIKELY BROKEN CHANGE Pass a proc to WEBrick::HTTPRequest#body to avoid reading a potentially large request body into memory during authentication. WARNING! this will break apps completely which want to do something with the body besides calculating the MD5 digest of it. Also, keep in mind that probably nobody uses "auth-int". Servers such as Apache, lighttpd, nginx don't seem to support it; nor does curl when using POST/PUT bodies; and we didn't have tests for it until now... * lib/webrick/httpauth/digestauth.rb (_authenticate): stream req.body git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62984 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: use InputBufferSize for chunked requestsnaruse
While WEBrick::HTTPRequest#body provides a Proc interface for streaming large request bodies, clients must not force the server to use an excessively large chunk size. * lib/webrick/httprequest.rb (read_chunk_size): limit each read and block.call to :InputBufferSize in config. * test/webrick/test_httpserver.rb (test_big_chunks): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62982 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: raise correct exceptionnaruse
"BadRequest" alone does not resolve correctly, it is in the HTTPStatus namespace. * lib/webrick/httprequest.rb (read_chunked): use correct exception * test/webrick/test_httpserver.rb (test_eof_in_chunk): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62981 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httpservlet/cgihandler: reduce memory usenaruse
WEBrick::HTTPRequest#body can be passed a block to process the body in chunks. Use this feature to avoid building a giant string in memory. * lib/webrick/httpservlet/cgihandler.rb (do_GET): avoid reading entire request body into memory (do_POST is aliased to do_GET, so it handles bodies) git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62980 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28webrick/httprequest: limit request headers sizenaruse
We use the same 112 KB limit started (AFAIK) by Mongrel, Thin, and Puma to prevent malicious users from using up all the memory with a single request. This also limits the damage done by excessive ranges in multipart Range: requests. Due to the way we rely on IO#gets and the desire to keep the code simple, the actual maximum header may be 4093 bytes larger than 112 KB, but we're splitting hairs at that point. * lib/webrick/httprequest.rb: define MAX_HEADER_LENGTH (read_header): raise when headers exceed max length git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62979 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-28Remove directory separatorsnaruse
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62971 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-03-19merge revision(s) 62244,62246,62301,62302,62303,62422,62436,62452: [Backport ↵naruse
#14481] Merge RubyGems-2.7.5 from upstream. Please see its details: http://blog.rubygems.org/2018/02/06/2.7.5-released.html test_gem_util.rb: fix broken test * test/rubygems/test_gem_util.rb: no guarantee that tmpdir is always underneath the root directory at all. test_gem_commands_setup_command.rb: BUNDLER_VERS * test/rubygems/test_gem_commands_setup_command.rb: run bundled gem command, instead of installed one. no need to set bundled bundler unless Gem::USE_BUNDLER_FOR_GEMDEPS revert r62302 and force to define the version constant Merge RubyGems 2.7.6 from upstream. It fixed some security vulnerabilities. http://blog.rubygems.org/2018/02/15/2.7.6-released.html fix regexp literal warning. test/rubygems/test_gem_server.rb: eliminate duplicated character class warning. [Bug #14481] Remove unnecessary `[]`s git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62837 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-02-21merge revision(s) 61469: [Backport #14427]naruse
irb.rb: fix highlight * lib/irb.rb (IRB::Irb#eval_input): fix highlight for multiple lines exception messages. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62510 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-02-16merge revision(s) 61639: [Backport #14323]naruse
net/ftp: fix FrozenError in BufferedSocket I noticed this bug while working on something else with RUBYOPT=-d on, existing test cases all passed with it. Note: I use String.new because it is the local style, here, I prefer +'' (or ''.b, for a future commit) * lib/net/ftp.rb (BufferedSocket#read): use String.new * test/net/ftp/test_buffered_socket.rb (test_read_nil): new test [ruby-core:84675] [Bug #14323] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62425 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2018-01-03merge revision(s) 61497: [Backport #14243]naruse
erb.rb: preserve the behavior for invalid syntax comment. Fix regression at r58948. I even don't want to deprecate it because deprecation needs to lex all embedded Ruby script using Ripper and it would be slow. So Let me just keep this behavior of Ruby 2.4. No change is the best compatibility. This commit stopped using String#-@ because it's harmful for "ambiguous first argument" warning if we really want to maintain this behavior. [Bug #14243] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@61581 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-25fix leaked fdsnobu
* lib/rubygems/command.rb (Gem::Command#invoke_with_build_args): restore UI and close the created SilentUI. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61465 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-24webrick 1.4.2normal
This release removes uses of Kernel#open to avoid unintended behaviors and make future auditing easier. [Misc #14216] 6 changes since 1.4.1: webrick: httpauth requires regular files webrick/httpservlet/cgi_runner.rb: remove unnecessary open webrick: WEBrick::Log requires path arg when given string webrick/httpservlet/*handler: use File.open webrick/httputils: note Kernel#open behavior webrick/httpservelet/cgi_runner: avoid IO#reopen on pathname git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61443 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-24lib/irb.rb: highlight exceptionsnobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61435 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-24lib/irb.rb: simplified backtrace filteringnobu
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61434 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-23Merge rdoc-6.0.1.hsbt
It fixes an installation error of activerecord. https://github.com/ruby/rdoc/issues/571 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61432 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-23Print backtrace in reverse order on IRB toosorah
[Feature #8861] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61431 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22Postponing the Bundler merge.hsbt
I faced a big issue about Bundler with ruby core. I have no time to resolve it issue before 2.5 final release. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61416 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22erb.rb: shadow by keysnobu
* lib/erb.rb (ERB#new_toplevel): shadow already defined local variables by block local variabes, not to overwrite them. [ruby-core:84390] [Bug #14215] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61411 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22Bump up fileutils-1.0.2hsbt
Added `FileUtils::VERSION` const variable. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61410 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservelet/cgi_runner: avoid IO#reopen on pathnamenormal
IO#reopen seems to behave strangely on Win32 based on the logs posted by Greg for [Bug #14420]. Lets try to fix the issue by using File.open explicitly (but not Kernel#open). * lib/webrick/httpservelet/cgi_runner: use File.open explicitly [Bug #14220] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61409 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httputils: note Kernel#open behaviornormal
I don't know who uses the load_mime_types method; but it is conceivable that a user would want to read the results of a command instead of reading a regular file to load MIME types. None of the WEBrick-related code in Ruby or default/bundled gems seems to rely on this method; but it is likely 3rd-party code does. * lib/webrick/httputils.rb (load_mime_types): note Kernel#open behavior [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61402 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservlet/*handler: use File.opennormal
This makes future code audits easier. None of these changes fix realistic remote code execution vulnerabilities because we stat(2) before attempting Kernel#open. * lib/webrick/httpservlet/erbhandler.rb (do_GET): use File.open * lib/webrick/httpservlet/filehandler.rb (do_GET): use File.open (make_partial_content): ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61401 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick: WEBrick::Log requires path arg when given stringnormal
Allowing a user to specify "| command" via Kernel#open is nonsensical since we never read from the resultant IO. * lib/webrick/log.rb (initialize): replace Kernel#open with File.open [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61400 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick/httpservlet/cgi_runner.rb: remove unnecessary opennormal
IO#reopen already takes string path names as well as IO objects (but not "| command" strings) This makes further auditing for inadvertant code execution easier. There's no actual bugfix or behavior change here, as no external data is passed to cgi_runner.rb. * lib/webrick/httpservlet/cgi_runner.rb: remove Kernel#open call [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61398 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-22webrick: httpauth requires regular filesnormal
Be sure we do not try to open a pipe to read from, since we care about mtime in all cases. * lib/webrick/httpauth/htdigest.rb: use File.open * lib/webrick/httpauth/htgroup.rb: ditto * lib/webrick/httpauth/htpasswd.rb: ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61397 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-12-21open-uri defines URI.open defined as an alias.akr
open-uri's Kernel.open will be deprecated in future. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61392 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-22 11:35:29 +0000