Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: rack/rack
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.0.6.1
Choose a base ref
...
head repository: rack/rack
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.0.9.1
Choose a head ref
  • 15 commits
  • 16 files changed
  • 5 contributors

Commits on Mar 13, 2023

  1. Update changelog.

    ioquatix committed Mar 13, 2023
    Configuration menu
    Copy the full SHA
    54a9ed2 View commit details
    Browse the repository at this point in the history
  2. Merge branch '3-0-sec' into 3-0-stable

    * 3-0-sec:
      bump version
      Avoid ReDoS problem
    tenderlove committed Mar 13, 2023
    Configuration menu
    Copy the full SHA
    51e7a0f View commit details
    Browse the repository at this point in the history

Commits on Mar 16, 2023

  1. Make query parameters without = have nil values (#2059) (#2060)

    * Revert "Prefer to use `query_parser` itself as the cache key. (#2058)"
    
    This reverts commit 5f90c33.
    
    * Revert "Fix handling of cached values in `Rack::Request`. (#2054)"
    
    This reverts commit d25fedd.
    
    * Revert "Add `QueryParser#missing_value` for handling missing values + tests. (#2052)"
    
    This reverts commit 59d9ba9.
    
    * Revert "Split form/query parsing into two steps (#2038)"
    
    This reverts commit 9f059d1.
    
    * Make query parameters without = have nil values
    
    This was Rack's historical behavior.  While it doesn't match
    URL spec section 5.1.3.3, keeping the historical behavior avoids
    all of the complexity required to support the URL spec standard
    by default, but also support frameworks that want to be backwards
    compatible.
    
    This keeps as much of the specs added by the recently reverted
    commits that make sense.
    # Conflicts:
    #	lib/rack/multipart.rb
    #	lib/rack/request.rb
    #	test/spec_request.rb
    ioquatix authored Mar 16, 2023
    Configuration menu
    Copy the full SHA
    d38b456 View commit details
    Browse the repository at this point in the history
  2. Update changelog.

    ioquatix committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    94dd78b View commit details
    Browse the repository at this point in the history
  3. Bump patch version.

    ioquatix committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    2429b7b View commit details
    Browse the repository at this point in the history

Commits on Jun 14, 2023

  1. Configuration menu
    Copy the full SHA
    32736d2 View commit details
    Browse the repository at this point in the history
  2. Bump patch verison.

    ioquatix committed Jun 14, 2023
    Configuration menu
    Copy the full SHA
    d28c464 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    8d1bf99 View commit details
    Browse the repository at this point in the history

Commits on Jan 31, 2024

  1. Fix content-length calcuation in Rack:Response#write (#2150)

    When `Rack::Response` is initialized with an Array, it incorrectly
    increments its internal `@length` value and emitted content-length
    header on every subsequent write. The more times `write` is called, the
    more the error accumulates.
    
    This commit fixes the accumulation bug, and fixes/adds specs to properly
    test the scenario where `write` is used multiple times.
    mattbrictson authored and ioquatix committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    c8b977f View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    d3d415e View commit details
    Browse the repository at this point in the history
  3. Bump patch version.

    ioquatix committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    0b3f997 View commit details
    Browse the repository at this point in the history

Commits on Feb 21, 2024

  1. Fixing ReDoS in header parsing

    Thanks svalkanov
    
    [CVE-2024-26146]
    tenderlove committed Feb 21, 2024
    Configuration menu
    Copy the full SHA
    a227cd7 View commit details
    Browse the repository at this point in the history
  2. Return an empty array when ranges are too large

    If the sum of the requested ranges is larger than the file itself,
    return an empty array. In other words, refuse to respond with any bytes.
    
    [CVE-2024-26141]
    tenderlove committed Feb 21, 2024
    Configuration menu
    Copy the full SHA
    4849132 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    6efb2ce View commit details
    Browse the repository at this point in the history
  4. bump version

    tenderlove committed Feb 21, 2024
    Configuration menu
    Copy the full SHA
    a4bc5e0 View commit details
    Browse the repository at this point in the history
Loading