rubygem-rack/Fix-CVE-2025-25184.patch

35 lines
1.2 KiB
Diff
Raw Normal View History

From 074ae244430cda05c27ca91cda699709cfb3ad8e Mon Sep 17 00:00:00 2001
From: Jeremy Evans <code@jeremyevans.net>
Date: Tue, 11 Feb 2025 19:10:05 -0800
Subject: [PATCH] Escape non-printable characters when logging.
---
lib/rack/common_logger.rb | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/rack/common_logger.rb b/lib/rack/common_logger.rb
index 9c6f921..68399c7 100644
--- a/lib/rack/common_logger.rb
+++ b/lib/rack/common_logger.rb
@@ -15,7 +15,7 @@ module Rack
# The actual format is slightly different than the above due to the
# separation of SCRIPT_NAME and PATH_INFO, and because the elapsed
# time in seconds is included at the end.
- FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f\n}
+ FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f }
# +logger+ can be any object that supports the +write+ or +<<+ methods,
# which includes the standard library Logger. These methods are called
@@ -60,7 +60,8 @@ module Rack
length,
Utils.clock_time - began_at ]
- msg.gsub!(/[^[:print:]\n]/) { |c| "\\x#{c.ord}" }
+ msg.gsub!(/[^[:print:]]/) { |c| sprintf("\\x%x", c.ord) }
+ msg[-1] = "\n"
logger = @logger || env[RACK_ERRORS]
--
2.46.0