rubygem-excon/CVE-2019-16779.patch
2021-11-01 15:00:24 +08:00

68 lines
1.9 KiB
Diff

From 0ca3cd81f43bf250df08a209a9ee709584935600 Mon Sep 17 00:00:00 2001
From: geemus <geemus@gmail.com>
Date: Mon, 1 Nov 2021 10:20:15 +0800
Subject: [PATCH] fix for leftover data with interrupted persistent connections
---
lib/excon/connection.rb | 9 ++++++++-
tests/rackups/basic.rb | 8 ++++++++
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/lib/excon/connection.rb b/lib/excon/connection.rb
index d27827f..25f89a3 100644
--- a/lib/excon/connection.rb
+++ b/lib/excon/connection.rb
@@ -252,6 +252,11 @@ module Excon
datum[:connection] = self
+ # cleanup data left behind on persistent connection after interrupt
+ if datum[:persistent] && !@persistent_socket_reusable
+ reset
+ end
+
datum[:stack] = datum[:middlewares].map do |middleware|
lambda {|stack| middleware.new(stack)}
end.reverse.inject(self) do |middlewares, middleware|
@@ -260,8 +265,9 @@ module Excon
datum = datum[:stack].request_call(datum)
unless datum[:pipeline]
+ @persistent_socket_reusable = false
datum = response(datum)
-
+ @persistent_socket_reusable = true
if datum[:persistent]
if key = datum[:response][:headers].keys.detect {|k| k.casecmp('Connection') == 0 }
if datum[:response][:headers][key].casecmp('close') == 0
@@ -330,6 +336,7 @@ module Excon
if old_socket = sockets.delete(@socket_key)
old_socket.close rescue nil
end
+ @persistent_socket_reusable = true
end
# Generate HTTP request verb methods
diff --git a/tests/rackups/basic.rb b/tests/rackups/basic.rb
index 0bddd9a..e474a58 100644
--- a/tests/rackups/basic.rb
+++ b/tests/rackups/basic.rb
@@ -31,6 +31,14 @@ class Basic < Sinatra::Base
get('/echo dirty') do
echo
end
+
+ get('/foo') do
+ 'foo'
+ end
+
+ get('/bar') do
+ 'bar'
+ end
private
--
2.27.0