8792 Commits
Author SHA1 Message Date
Hiroshi SHIBATA 7957a25edf Merge RDoc-6.3.4.1 2024-04-23 16:02:50 +09:00
Hiroshi SHIBATA 616926b55e CVE-2023-36617 for Ruby 3.0 (#7997)
* Merge URI-0.10.3

* Merge URI-0.10.0.3 for Bundler
2023-06-29 13:25:17 +00:00
NAKAMURA Usaku 23a532679b Fix previous commit 2023-03-30 21:41:03 +09:00
NAKAMURA Usaku 4ec0bac2d9 Limit header length 2023-03-30 20:10:01 +09:00
Hiroshi SHIBATA 53a7cee685 Merge Time-0.1.1 2023-03-30 19:49:08 +09:00
Hiroshi SHIBATA 2d99ef4f74 Merge URI-0.10.2 for Ruby 3.0 (#7607)
* Merge URI-0.10.2

* Merge URI-0.10.0.2 for bundler

* Added assert_linear_performance for URI tests
2023-03-29 05:54:14 +00:00
Hiroshi SHIBATA cbe2c0cd09 Merge CGI-0.2.2 2022-11-24 11:21:28 +09:00
Nobuyoshi Nakada 2ae567acab [Bug #19005] dynamic_lookup linker option in external libraries
The warning against `-undefined dynamic_lookup` is just a warning yet,
and many gems seem to pay no attention to warnings.  Until it fails
actually, keep it as a migration path, except for standard extension
libraries and bundled extension gems.
2022-10-01 15:58:25 +09:00
Hiroshi SHIBATAandYuta Saito 7900a9bd38 Backport https://github.com/ruby/ruby/pull/6193
Co-authored-by: Yuta Saito <kateinoigakukun@gmail.com>
2022-09-16 15:12:47 +09:00
Hiroshi SHIBATA cdec8a29c5 Merge Bundler-2.2.33 2022-04-12 14:07:25 +09:00
Hiroshi SHIBATA 48be8051ef Merge RubyGems-3.2.33 2022-04-12 14:07:25 +09:00
nagachika 3fb7d2cadc Fix integer overflow
Make use of the check in rb_alloc_tmp_buffer2.

    https://hackerone.com/reports/1328463

    When parsing cookies, only decode the values

    Bump version

    Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
    Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
2021-11-24 20:12:15 +09:00
Hiroshi SHIBATA c2125240cc Merge RubyGems-3.2.32 and Bundler-2.2.32 2021-11-24 19:46:22 +09:00
Hiroshi SHIBATA 5a6f8462dc Bump racc version to 1.5.2 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA d7c9d86573 Bump resolv version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA b789399c09 Bump rdoc version to 6.3.3 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 989540c9cc Bump pp version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA f86b773b5c Bump rinda version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 60d904c4b2 Bump prettyprint version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA e735773fd4 Bump optparse version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA b2b66ede71 Bump net-protocol version to 0.1.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 8ddad13dcd Bump debug version to 0.2.1 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 905842e122 Bump debug version to 0.2.0 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA b19b2e9867 Merge RubyGems 3.2.31 and Bundler 2.2.31 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA e27381d289 Merge RubyGems 3.2.30 and Bundler 2.2.30 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA e262272b6a Merge RubyGems 3.2.29 and Bundler 2.2.29 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 24f911f474 Merge RubyGems 3.2.28 and Bundler 2.2.28 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 31a7104852 Merge RubyGems 3.2.27 and Bundler 2.2.27 2021-11-22 10:51:35 +09:00
Hiroshi SHIBATA 519e3bde24 [ruby/drb] Bump up drb version to 2.0.5
https://github.com/ruby/drb/commit/7edf67654c
2021-10-30 20:53:12 +09:00
Hiroshi SHIBATA 37f824377f Merge RubyGems 3.2.26 and Bundler 2.2.26 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA 41a2863780 Merge RubyGems 3.2.25 and Bundler 2.2.25 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA 679185d6c8 Merge RubyGems 3.2.24 and Bundler 2.2.24 2021-08-19 15:46:40 +09:00
Hiroshi SHIBATA f1039afa41 Merge RubyGems 3.2.23 and Bundler 2.2.23 2021-08-19 15:46:40 +09:00
Shugo Maeda e2ac25d0eb Fix StartTLS stripping vulnerability
This fixes CVE-2021-32066.
Reported by Alexandr Savca in <https://hackerone.com/reports/1178562>.
2021-07-07 19:08:18 +09:00
Yusuke EndohandShugo Maeda bf4d05173c Ignore IP addresses in PASV responses by default, and add new option use_pasv_ip
This fixes CVE-2021-31810.
Reported by Alexandr Savca.

Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
2021-07-07 19:05:36 +09:00
Hiroshi SHIBATA ec171fa1f9 Merge RubyGems-3.2.22 and Bundler-2.2.22 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA 865221f0ba Merge RubyGems-3.2.21 and Bundler-2.2.21 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA bf0e7095dc Use the latest version of Bundler's gemspec 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA 1e98ec27f6 Merge RubyGems-3.2.20 and Bundler-2.2.20 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA f63d3bbb6e Merge RubyGems-3.2.19 and Bundler-2.2.19 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA d4b4281959 Merge RubyGems-3.2.18 and Bundler-2.2.18 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA dd28c03d5f Merge RubyGems-3.2.17 and Bundler-2.2.17 2021-07-07 10:03:15 +09:00
Hiroshi SHIBATA 3e2f089432 Merge RubyGems-3.2.16 and Bundler-2.2.16 2021-07-07 10:03:15 +09:00
nagachika 3d6b5c2313 merge revision(s) 773c690f25:
[ruby/net-ftp] Bump version to 0.1.2

	https://github.com/ruby/net-ftp/commit/895ba44b3c
	---
	 lib/net/ftp.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-06-10 16:09:02 +09:00
nagachika 02411b16af merge revision(s) 1b2abb6590:
[ruby/net-ftp] Replace "iff" with "if and only if"

	iff means if and only if, but readers without that knowledge might
	assume this to be a spelling mistake. To me, this seems like
	exclusionary language that is unnecessary. Simply using "if and only if"
	instead should suffice.

	https://github.com/ruby/net-ftp/commit/e920473618
	---
	 lib/net/ftp.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-06-10 16:07:25 +09:00
nagachika 6363492817 merge revision(s) 990baec411:
[ruby/net-ftp] Close the passive connection data socket if there is
	 an error setting up the transfer

	Previously, the connection leaked in this case.  This uses
	begin/ensure and checking for an error in the ensure block.

	An alternative approach would be to not even perform the
	connection until after the RETR (or other) command has been
	sent.  However, I'm not sure all FTP servers support that.
	The current behavior is:

	* Send (PASV/EPSV)
	* Connect to the host/port returned in 227/229 reply
	* Send (RETR/other command)

	Changing it to connect after the RETR could break things.
	FTP servers might expect that the client has already
	connected before sending the RETR.  The alternative
	approach is more likely to introduce backwards compatibility
	issues, compared to the begin/ensure approach taken here.

	Fixes Ruby Bug 17027

	https://github.com/ruby/net-ftp/commit/6e8535f076
	---
	 lib/net/ftp.rb           | 24 ++++++++++++++----------
	 test/net/ftp/test_ftp.rb | 39 +++++++++++++++++++++++++++++++++++++--
	 2 files changed, 51 insertions(+), 12 deletions(-)
2021-06-10 16:06:01 +09:00
nagachika ced669aed0 merge revision(s) a86c6cb34d:
[ruby/net-ftp] Replace Timeout.timeout with socket timeout

	Timeout.timeout is inefficient since it spins up a new thread for
	each invocation, use Socket.tcp's connect_timeout option instead
	when we aren't using SOCKS (we can't replace Timeout.timeout
	for SOCKS yet since SOCKSSocket doesn't have a connect_timeout
	option).

	https://github.com/ruby/net-ftp/commit/d65910132f
	---
	 lib/net/ftp.rb | 17 +++++++++++------
	 1 file changed, 11 insertions(+), 6 deletions(-)
2021-06-10 16:01:53 +09:00
nagachika 9d63a8dd0b merge revision(s) 5cdf99f64e: [Backport #17761]
mkmf: fixed install directories of header files in extension
	 libraries [Bug #17761]

	When installing an extension library which provides a header, that
	header should be installed under site_ruby (or vendor_ruby when
	"--vendor" option was given to extconf.rb).  However, currently
	this file is about to be installed in the core include directory.
	---
	 lib/mkmf.rb               |  8 ++++----
	 test/mkmf/test_install.rb | 30 ++++++++++++++++++++++++++++++
	 2 files changed, 34 insertions(+), 4 deletions(-)
	 create mode 100644 test/mkmf/test_install.rb
2021-05-29 13:39:20 +09:00
nagachika 5e21726cda merge revision(s) 799ea1d154: [Backport #16651]
mkmf.rb: convert also arch_hdrdir [Bug #16651]

	---
	 lib/mkmf.rb | 2 +-
	 1 file changed, 1 insertion(+), 1 deletion(-)
2021-05-22 16:27:29 +09:00
nagachika 9c0df2e81c merge revision(s) 9edc162583: [Backport #17781]
[ruby/resolv] Fix confusion of received response message

	This is a follow up for commit 33fb966197f1 ("Remove sender/message_id
	pair after response received in resolv", 2020-09-11).

	As the @senders instance variable is also used for tracking transaction
	ID allocation, simply removing an entry without releasing the ID would
	eventually deplete the ID space and cause
	Resolv::DNS.allocate_request_id to hang.

	It seems the intention of the code was to check that the received DNS
	message is actually the response for the question made within the method
	earlier. Let's have it actually do so.

	[Bug #12838] https://bugs.ruby-lang.org/issues/12838
	[Bug #17748] https://bugs.ruby-lang.org/issues/17748

	https://github.com/ruby/resolv/commit/53ca9c9209
	---
	 lib/resolv.rb | 6 +++---
	 1 file changed, 3 insertions(+), 3 deletions(-)
2021-05-22 15:20:23 +09:00