8792 Commits

Author SHA1 Message Date
Hiroshi SHIBATA
7957a25edf Merge RDoc-6.3.4.1 2024-04-23 16:02:50 +09:00
Hiroshi SHIBATA
616926b55e
CVE-2023-36617 for Ruby 3.0 (#7997)
* Merge URI-0.10.3

* Merge URI-0.10.0.3 for Bundler
2023-06-29 13:25:17 +00:00
NAKAMURA Usaku
23a532679b
Fix previous commit 2023-03-30 21:41:03 +09:00
NAKAMURA Usaku
4ec0bac2d9
Limit header length 2023-03-30 20:10:01 +09:00
Hiroshi SHIBATA
53a7cee685 Merge Time-0.1.1 2023-03-30 19:49:08 +09:00
Hiroshi SHIBATA
2d99ef4f74
Merge URI-0.10.2 for Ruby 3.0 (#7607)
* Merge URI-0.10.2

* Merge URI-0.10.0.2 for bundler

* Added assert_linear_performance for URI tests
2023-03-29 05:54:14 +00:00
Hiroshi SHIBATA
cbe2c0cd09 Merge CGI-0.2.2 2022-11-24 11:21:28 +09:00
Nobuyoshi Nakada
2ae567acab [Bug #19005] dynamic_lookup linker option in external libraries
The warning against `-undefined dynamic_lookup` is just a warning yet,
and many gems seem to pay no attention to warnings.  Until it fails
actually, keep it as a migration path, except for standard extension
libraries and bundled extension gems.
2022-10-01 15:58:25 +09:00
Hiroshi SHIBATA
7900a9bd38 Backport https://github.com/ruby/ruby/pull/6193
Co-authored-by: Yuta Saito <kateinoigakukun@gmail.com>
2022-09-16 15:12:47 +09:00
Hiroshi SHIBATA
cdec8a29c5 Merge Bundler-2.2.33 2022-04-12 14:07:25 +09:00
Hiroshi SHIBATA
48be8051ef Merge RubyGems-3.2.33 2022-04-12 14:07:25 +09:00
nagachika
3fb7d2cadc Fix integer overflow
Make use of the check in rb_alloc_tmp_buffer2.

    https://hackerone.com/reports/1328463

    When parsing cookies, only decode the values

    Bump version

    Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
    Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
2021-11-24 20:12:15 +09:00
Hiroshi SHIBATA
c2125240cc Merge RubyGems-3.2.32 and Bundler-2.2.32 2021-11-24 19:46:22 +09:00
Hiroshi SHIBATA
5a6f8462dc Bump racc version to 1.5.2 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
d7c9d86573 Bump resolv version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
b789399c09 Bump rdoc version to 6.3.3 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
989540c9cc Bump pp version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
f86b773b5c Bump rinda version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
60d904c4b2 Bump prettyprint version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
e735773fd4 Bump optparse version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
b2b66ede71 Bump net-protocol version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
8ddad13dcd Bump debug version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
905842e122 Bump debug version to 0.2.0 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
b19b2e9867 Merge RubyGems 3.2.31 and Bundler 2.2.31 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
e27381d289 Merge RubyGems 3.2.30 and Bundler 2.2.30 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
e262272b6a Merge RubyGems 3.2.29 and Bundler 2.2.29 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
24f911f474 Merge RubyGems 3.2.28 and Bundler 2.2.28 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
31a7104852 Merge RubyGems 3.2.27 and Bundler 2.2.27 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA
519e3bde24 [ruby/drb] Bump up drb version to 2.0.5
https://github.com/ruby/drb/commit/7edf67654c
2021-10-30 20:53:12 +09:00
Hiroshi SHIBATA
37f824377f Merge RubyGems 3.2.26 and Bundler 2.2.26 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA
41a2863780 Merge RubyGems 3.2.25 and Bundler 2.2.25 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA
679185d6c8 Merge RubyGems 3.2.24 and Bundler 2.2.24 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA
f1039afa41 Merge RubyGems 3.2.23 and Bundler 2.2.23 2021-08-19 15:46:40 +09:00
Shugo Maeda
e2ac25d0eb Fix StartTLS stripping vulnerability
This fixes CVE-2021-32066.
Reported by Alexandr Savca in <https://hackerone.com/reports/1178562>.
2021-07-07 19:08:18 +09:00
Yusuke Endoh
bf4d05173c Ignore IP addresses in PASV responses by default, and add new option use_pasv_ip
This fixes CVE-2021-31810.
Reported by Alexandr Savca.

Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
2021-07-07 19:05:36 +09:00
Hiroshi SHIBATA
ec171fa1f9 Merge RubyGems-3.2.22 and Bundler-2.2.22 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
865221f0ba Merge RubyGems-3.2.21 and Bundler-2.2.21 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
bf0e7095dc Use the latest version of Bundler's gemspec 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
1e98ec27f6 Merge RubyGems-3.2.20 and Bundler-2.2.20 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
f63d3bbb6e Merge RubyGems-3.2.19 and Bundler-2.2.19 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
d4b4281959 Merge RubyGems-3.2.18 and Bundler-2.2.18 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
dd28c03d5f Merge RubyGems-3.2.17 and Bundler-2.2.17 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA
3e2f089432 Merge RubyGems-3.2.16 and Bundler-2.2.16 2021-07-07 10:03:15 +09:00
nagachika
3d6b5c2313 merge revision(s) 773c690f2553db31a9cc83a037f5449e0c1ea456:
[ruby/net-ftp] Bump version to 0.1.2

	https://github.com/ruby/net-ftp/commit/895ba44b3c
	---
	 lib/net/ftp.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-06-10 16:09:02 +09:00
nagachika
02411b16af merge revision(s) 1b2abb6590a653cb7b31d73c42edbaf2d0617b27:
[ruby/net-ftp] Replace "iff" with "if and only if"

	iff means if and only if, but readers without that knowledge might
	assume this to be a spelling mistake. To me, this seems like
	exclusionary language that is unnecessary. Simply using "if and only if"
	instead should suffice.

	https://github.com/ruby/net-ftp/commit/e920473618
	---
	 lib/net/ftp.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-06-10 16:07:25 +09:00
nagachika
6363492817 merge revision(s) 990baec41174a0b4cf7e285cf3185b4ab444437e:
[ruby/net-ftp] Close the passive connection data socket if there is
	 an error setting up the transfer

	Previously, the connection leaked in this case.  This uses
	begin/ensure and checking for an error in the ensure block.

	An alternative approach would be to not even perform the
	connection until after the RETR (or other) command has been
	sent.  However, I'm not sure all FTP servers support that.
	The current behavior is:

	* Send (PASV/EPSV)
	* Connect to the host/port returned in 227/229 reply
	* Send (RETR/other command)

	Changing it to connect after the RETR could break things.
	FTP servers might expect that the client has already
	connected before sending the RETR.  The alternative
	approach is more likely to introduce backwards compatibility
	issues, compared to the begin/ensure approach taken here.

	Fixes Ruby Bug 17027

	https://github.com/ruby/net-ftp/commit/6e8535f076
	---
	 lib/net/ftp.rb           | 24 ++++++++++++++----------
	 test/net/ftp/test_ftp.rb | 39 +++++++++++++++++++++++++++++++++++++--
	 2 files changed, 51 insertions(+), 12 deletions(-)
2021-06-10 16:06:01 +09:00
nagachika
ced669aed0 merge revision(s) a86c6cb34df0c44973efe6578ba1cd9150af22cf:
[ruby/net-ftp] Replace Timeout.timeout with socket timeout

	Timeout.timeout is inefficient since it spins up a new thread for
	each invocation, use Socket.tcp's connect_timeout option instead
	when we aren't using SOCKS (we can't replace Timeout.timeout
	for SOCKS yet since SOCKSSocket doesn't have a connect_timeout
	option).

	https://github.com/ruby/net-ftp/commit/d65910132f
	---
	 lib/net/ftp.rb | 17 +++++++++++------
	 1 file changed, 11 insertions(+), 6 deletions(-)
2021-06-10 16:01:53 +09:00
nagachika
9d63a8dd0b merge revision(s) 5cdf99f64e344b8e4638824d55f5caf33be682ca: [Backport #17761]
mkmf: fixed install directories of header files in extension
	 libraries [Bug #17761]

	When installing an extension library which provides a header, that
	header should be installed under site_ruby (or vendor_ruby when
	"--vendor" option was given to extconf.rb).  However, currently
	this file is about to be installed in the core include directory.
	---
	 lib/mkmf.rb               |  8 ++++----
	 test/mkmf/test_install.rb | 30 ++++++++++++++++++++++++++++++
	 2 files changed, 34 insertions(+), 4 deletions(-)
	 create mode 100644 test/mkmf/test_install.rb
2021-05-29 13:39:20 +09:00
nagachika
5e21726cda merge revision(s) 799ea1d1540aca03542ee31647052343507a4b41: [Backport #16651]
mkmf.rb: convert also arch_hdrdir [Bug #16651]

	---
	 lib/mkmf.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-05-22 16:27:29 +09:00
nagachika
9c0df2e81c merge revision(s) 9edc162583a4f685332239f6249745ad9b518cbe: [Backport #17781]
[ruby/resolv] Fix confusion of received response message

	This is a follow up for commit 33fb966197f1 ("Remove sender/message_id
	pair after response received in resolv", 2020-09-11).

	As the @senders instance variable is also used for tracking transaction
	ID allocation, simply removing an entry without releasing the ID would
	eventually deplete the ID space and cause
	Resolv::DNS.allocate_request_id to hang.

	It seems the intention of the code was to check that the received DNS
	message is actually the response for the question made within the method
	earlier. Let's have it actually do so.

	[Bug #12838] https://bugs.ruby-lang.org/issues/12838
	[Bug #17748] https://bugs.ruby-lang.org/issues/17748

	https://github.com/ruby/resolv/commit/53ca9c9209
	---
	 lib/resolv.rb | 6 +++---
	 1 file changed, 3 insertions(+), 3 deletions(-)
2021-05-22 15:20:23 +09:00