From 5ccca4722668083732ea2d35c56565fcc25312f8 Mon Sep 17 00:00:00 2001 From: Matt Langlois Date: Fri, 12 Jun 2020 12:57:34 -0600 Subject: [PATCH 1/2] When parsing cookies, only decode the values Patch utils to fix cookie parsing [CVE-2020-8184] --- lib/rack/utils.rb | 8 ++++++-- test/spec_utils.rb | 4 ++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb index f033c900d..d3b3b1d42 100644 --- a/lib/rack/utils.rb +++ b/lib/rack/utils.rb @@ -212,8 +212,12 @@ def parse_cookies_header(header) # The syntax for cookie headers only supports semicolons # User Agent -> Server == # Cookie: SID=31d4d96e407aad42; lang=en-US - cookies = parse_query(header, ';') { |s| unescape(s) rescue s } - cookies.each_with_object({}) { |(k, v), hash| hash[k] = Array === v ? v.first : v } + return {} unless header + header.split(/[;] */n).each_with_object({}) do |cookie, cookies| + next if cookie.empty? + key, value = cookie.split('=', 2) + cookies[key] = (unescape(value) rescue value) unless cookies.key?(key) + end end def add_cookie_to_header(header, key, value) diff --git a/test/spec_utils.rb b/test/spec_utils.rb index b39f4a00d..273dc6c1f 100644 --- a/test/spec_utils.rb +++ b/test/spec_utils.rb @@ -524,6 +524,10 @@ def initialize(*) env = Rack::MockRequest.env_for("", "HTTP_COOKIE" => "foo=bar").freeze Rack::Utils.parse_cookies(env).must_equal({ "foo" => "bar" }) + + env = Rack::MockRequest.env_for("", "HTTP_COOKIE" => "%66oo=baz;foo=bar") + cookies = Rack::Utils.parse_cookies(env) + cookies.must_equal({ "%66oo" => "baz", "foo" => "bar" }) end it "adds new cookies to nil header" do From 1741c580d71cfca8e541e96cc372305c8892ee74 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Mon, 15 Jun 2020 15:22:19 -0700 Subject: [PATCH 2/2] bump version --- CHANGELOG.md | 4 ++++ lib/rack/version.rb | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9e5ac7e43..e74cca0e1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/). +## [2.2.3] - 2020-02-11 + +- [CVE-2020-8184] Only decode cookie values + ## [2.2.2] - 2020-02-11 ### Fixed diff --git a/lib/rack/version.rb b/lib/rack/version.rb index 06f7b2cdc..aad9c5915 100644 --- a/lib/rack/version.rb +++ b/lib/rack/version.rb @@ -20,7 +20,7 @@ def self.version VERSION.join(".") end - RELEASE = "2.2.2" + RELEASE = "2.2.3" # Return the Rack release as a dotted string. def self.release