Update dependency sinatra to v4 [SECURITY] #197
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
@rultor please, try to merge |
@renovate[bot] @yegor256 Oops, I failed. You can see the full log here (spent 7min) |
renovate
bot
force-pushed
the
renovate/rubygems-sinatra-vulnerability
branch
from
dd144eb
to
cfeda62
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'2.0.4'->'4.1.0'GitHub Vulnerability Alerts
CVE-2022-29970
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
CVE-2022-45442
Description
An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.
References
CVE-2024-21510
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
Release Notes
sinatra/sinatra (sinatra)
v4.1.0Compare Source
host_authorizationsetting (#2053).localhost,.testand any IP address in development mode.Sinatra::IndifferentHashwhen calling#except(#2044)URIfor Ruby 3.4 (#2060)rackupno longer depends on WEBrick, recommend Puma instead (4a558503)--enable-frozen-string-literal(#2033)Rack::Loggercontent-lengthheader whenRack::Filesis usedv4.0.0Compare Source
New: Add support for Rack 3 (#1857)
Require Ruby 2.7.8 as minimum Ruby version (#1993)
Breaking change: Drop support for Rack 2 (#1857)
rackupgem installedBreaking change: Remove the
IndifferentHashinitializer (#1982)Breaking change: Disable
session_hijackingprotection by default (#1984)Breaking change: Remove
Rack::Protection::EncryptedCookie(#1989)Rack::Session::Cookie][Rack::Session::Cookie])v3.2.0Compare Source
New: Add
#exceptmethod toSinatra::IndifferentHash(#1940)New: Use
Exception#detailed_messageto show backtrace (#1952)New: Add
Sinatra::HamlHelpersto sinatra-contrib (#1960)Fix: Add
base64to rack-protection runtime dependencies (#1946)Fix: Avoid open-ended dependencies for sinatra-contrib and rack-protection (#1949)
Fix: Helpful message when
Sinatra::Runnertimes out (#1975)Fix: Ruby 3.3 + Bundler 2.5 compatibility (#1975)
v3.1.0Compare Source
New: Add sass support via sass-embedded #1911 by なつき
New: Add start and stop callbacks #1913 by Jevin Sew
New: Warn on dropping sessions #1900 by Jonathan del Strother
New: Make Puma the default server #1924 by Patrik Ragnarsson
Fix: Remove use of Tilt::Cache #1922 by Jeremy Evans (allows use of Tilt 2.2.0 without deprecation warning)
Fix: rack-protection: specify rack version requirement #1932 by Patrik Ragnarsson
v3.0.6Compare Source
Fix: Add support to keep open streaming connections with Puma #1858 by Jordan Owens
Fix: Avoid crash in
urihelper on Integer input #1890 by Patrik RagnarssonFix: Rescue
RuntimeErrorwhen trying to useSecureRandom#1888 by Stefan Sundinv3.0.5Compare Source
Fix: Add Zeitwerk compatibility. #1831 by Dawid Janczak
Fix: Allow CALLERS_TO_IGNORE to be overridden
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
Fix: Revert removal of rack-protection.rb. #1814 by Olle Jonsson
Fix: Revert change to server start and stop messaging by using Kernel#warn. Renamed internal warn method warn_for_deprecation. #1818 by Jordan Owens
v3.0.0Compare Source
New: Add Falcon support. #1794 by Samuel Williams and @horaciob
New: Add AES GCM encryption support for session cookies. [#1324] (https://github.com/sinatra/sinatra/pull/1324) by Michael Coyne
Deprecated: Sinatra Reloader will be removed in the next major release.
Fix: Internal Sinatra errors now extend
Sinatra::Error. This fixes #1204 and #1518. bda8c29d by Jordan OwensFix: Preserve query param value if named route param nil. #1676 by Jordan Owens
Require Ruby 2.6 as minimum Ruby version. #1699 by Eloy Pérez
Breaking change: Remove support for the Stylus template engine. #1697 by Eloy Pérez
Breaking change: Remove support for the erubis template engine. #1761 by Eloy Pérez
Breaking change: Remove support for the textile template engine. #1766 by Eloy Pérez
Breaking change: Remove support for SASS as a template engine. #1768 by Eloy Pérez
Breaking change: Remove support for Wlang as a template engine. #1780 by Eloy Pérez
Breaking change: Remove support for CoffeeScript as a template engine. #1790 by Eloy Pérez
Breaking change: Remove support for Mediawiki as a template engine. #1791 by Eloy Pérez
Breaking change: Remove support for Creole as a template engine. #1792 by Eloy Pérez
Breaking change: Remove support for Radius as a template engine. #1793 by Eloy Pérez
Breaking change: Remove support for the defunct Less templating library. See #1716, #1715 for more discussion and background. d1af2f1e by Olle Jonsson
Breaking change: Remove Reel integration. 54597502 by Olle Jonsson
CI: Start testing on Ruby 3.1. 60e221940 and b0fa4bef by Johannes Würbach
Use
Kernel#caller_locations. #1491 by Julik TarkhanovDocs: Japanese documentation: Add notes about the
default_content_typesetting. #1650 by Akifumi TominagaDocs: Polish documentation: Add section about Multithreaded modes and Routes. #1708 by Patrick Gramatowski
Docs: Japanese documentation: Make Session section reflect changes done to README.md. #1731 by @shu-i-chi
v2.2.4Compare Source
v2.2.3Compare Source
Fix: Escape filename in the Content-Disposition header. #1841 by Kunpei Sakai
Fix: fixed ReDoS for Rack::Protection::IPSpoofing. #1823 by @ooooooo-q
v2.2.2Compare Source
v2.2.1Compare Source
Fix JRuby regression by using ruby2_keywords for delegation. #1750 by Patrik Ragnarsson
Add JRuby to CI. #1755 by Karol Bucek
v2.2.0Compare Source
Breaking change: Add
#select,#rejectand#compactmethods toSinatra::IndifferentHash. If hash keys need to be converted to symbols, call#to_hto get aHashinstance first. #1711 by Olivier BelloneHandle EOFError raised by Rack and return Bad Request 400 status. #1743 by tamazon
Minor refactors in
base.rb. #1640 by ceclinuxAdd escaping to the static 404 page. #1645 by Chris Gavin
Remove
detect_rack_handlermethod. #1652 by ceclinuxRespect content type set in superclass before filter. Fixes #1647 #1649 by Jordan Owens
Revert "Use prepend instead of include for helpers. #1662 by namusyaka
Fix usage of inherited
Sinatra::Baseclasses keyword arguments. Fixes #1669 #1670 by Cadu RibeiroReduce RDoc generation time by not including every README. Fixes #1578 #1671 by Eloy Pérez
Add support for per form csrf tokens. Fixes #1616 #1653 by Jordan Owens
Update MAINTENANCE.md with the
stablebranch status. #1681 by Fredrik RubenssonValidate expanded path matches
public_dirwhen serving static files. #1683 by cji-stripeFix Delegator to pass keyword arguments for Ruby 3.0. #1684 by andrewtblake
Fix use with keyword arguments for Ruby 3.0. #1701 by Robin Wallin
Fix memory leaks for proc template. Fixes #1704 #1719 by Slevin
Remove unnecessary
test_filesfrom the gemspec. #1712 by Masataka Pocke KuwabaraDocs: Spanish documentation: Update README.es.md with removal of Thin. #1630 by Espartaco Palma
Docs: German documentation: Fixed typos in German README.md. #1648 by Juri
Docs: Japanese documentation: Update README.ja.md with removal of Thin. #1629 by Ryuichi KAWAMATA
Docs: English documentation: Various minor fixes to README.md. #1663 by Yanis Zafirópulos
Docs: English documentation: Document when
dump_errorsis enabled. Fixes #1664 #1665 by Patrik RagnarssonDocs: Brazilian Portuguese documentation: Update README.pt-br.md with translation fixes. #1668 by Vitor Oliveira
CI
Use latest JRuby 9.2.16.0 on CI. #1682 by Olle Jonsson
Switch CI from travis to GitHub Actions. #1691 by namusyaka
Skip the Slack action if
secrets.SLACK_WEBHOOKis not set. #1705 by Robin WallinSmall CI improvements. #1703 by Robin Wallin
Drop auto-generated boilerplate comments from CI configuration file. #1728 by Olle Jonsson
sinatra-contrib
Rack protection
origin_whitelistoption. Fixes #1641 #1642 by Takeshi YASHIROv2.1.0Compare Source
Fix additional Ruby 2.7 keyword warnings #1586 by Stefan Sundin
Drop Ruby 2.2 support #1455 by Eloy Pérez
Add Rack::Protection::ReferrerPolicy #1291 by Stefan Sundin
Add
default_content_typesetting. Fixes #1238 #1239 by Mike PastoreAllow
set :<engine>in sinatra-namespace #1255 by Christian HöppnerUse prepend instead of include for helpers. Fixes #1213 #1214 by Mike Pastore
Fix issue with passed routes and provides Fixes #1095 #1606 by Mike Pastore, Jordan Owens
Add QuietLogger that excludes paths from Rack::CommonLogger 1250 by Christoph Wagner
Sinatra::Contrib dependency updates. Fixes #1207 #1411 by Mike Pastore
Allow CSP to fallback to default-src. Fixes #1484 #1490 by Jordan Owens
Replace
origin_whitelistwithpermitted_origins. Closes #1620 #1625 by rhymesUse Rainbows instead of thin for async/stream features. Closes #1624 #1627 by Ryuichi KAWAMATA
Enable EscapedParams if passed via settings. Closes #1615 #1632 by Anders Bälter
Support for parameters in mime types. Fixes #1141 by John Hope
Handle null byte when serving static files #1574 by Kush Fanikiso
Improve development support and documentation and source code by Olle Jonsson, Pierre-Adrien Buisson, Shota Iguchi
v2.0.8.1Compare Source
mergeandmerge!forSinatra::IndifferentHash#1572 by Shota Iguchiv2.0.8Compare Source
mergeandmerge!forSinatra::IndifferentHash#1572 by Shota Iguchiv2.0.7Compare Source
v2.0.6Compare Source
Fix an issue setting environment from command line option #1547, #1554 by Jordan Owens, Kunpei Sakai
Support pandoc as a new markdown renderer #1533 by Vasiliy
Remove outdated code for tilt 1.x #1532 by Vasiliy
Remove an extra logic for
force_encoding#1527 by Jordan OwensAvoid multiple errors even if
paramscontains special values #1526 by Kunpei SakaiSupport
bundler/inlinewithrequire 'sinatra'integration #1520 by Kunpei SakaiAvoid
TypeErrorwhen params contain a key without a value on Ruby < 2.4 #1516 by Samuel GiddinsImprove development support and documentation and source code by Olle Jonsson, Basavanagowda Kanur, Yuki MINAMIYA
v2.0.5Compare Source
Avoid FrozenError when params contains frozen value #1506 by Kunpei Sakai
Add support for Erubi #1494 by @tkmru
IndifferentHashmonkeypatch warning improvements #1477 by Mike PastoreImprove development support and documentation and source code by Anusree Prakash, Jordan Owens, @ceclinux and @krororo.
sinatra-contrib
Add
flushoption tocontent_for#1225 by Shota IguchiDrop activesupport dependency from sinatra-contrib #1448
Update
yield_contentto append default to ERB template buffer #1500 by Jordan Owensrack-protection
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.