diff --git a/CHANGELOG.md b/CHANGELOG.md index 85cb1fc2a..b8f796794 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,16 +10,16 @@ All notable changes to this project will be documented in this file. For info on - [CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts -## [2.2.6.2] - 2022-01-17 +## [2.2.6.2] - 2023-01-17 - [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges -## [2.2.6.1] - 2022-01-17 +## [2.2.6.1] - 2023-01-17 - [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser - [CVE-2022-44572] Forbid control characters in attributes (also ReDoS) -## [2.2.6] - 2022-01-17 +## [2.2.6] - 2023-01-17 - Extend `Rack::MethodOverride` to handle `QueryParser::ParamsTooDeepError` error. ([#2011](https://github.com/rack/rack/pull/2011), [@byroot](https://github.com/byroot)) diff --git a/lib/rack/request.rb b/lib/rack/request.rb index fea984590..0bd8ee458 100644 --- a/lib/rack/request.rb +++ b/lib/rack/request.rb @@ -608,7 +608,7 @@ def split_header(value) (?[\d\.]+) | # A hostname: - (?[a-zA-Z0-9\.\-]+) + (?[a-zA-Z0-9\.\-_]+) ) # The optional port: (:(?\d+))? diff --git a/lib/rack/version.rb b/lib/rack/version.rb index d451de434..1aee4daa7 100644 --- a/lib/rack/version.rb +++ b/lib/rack/version.rb @@ -20,7 +20,7 @@ def self.version VERSION.join(".") end - RELEASE = "2.2.6.4" + RELEASE = "2.2.7" # Return the Rack release as a dotted string. def self.release diff --git a/test/spec_request.rb b/test/spec_request.rb index 51cfcdc88..db52dea29 100644 --- a/test/spec_request.rb +++ b/test/spec_request.rb @@ -121,6 +121,11 @@ class RackRequestTest < Minitest::Spec req.host.must_equal "123foo.example.com" req.hostname.must_equal "123foo.example.com" + req = make_request \ + Rack::MockRequest.env_for("/", "HTTP_HOST" => "some_service:3001") + req.host.must_equal "some_service" + req.hostname.must_equal "some_service" + req = make_request \ Rack::MockRequest.env_for("/", "SERVER_NAME" => "example.org", "SERVER_PORT" => "9292") req.host.must_equal "example.org" @@ -156,6 +161,10 @@ class RackRequestTest < Minitest::Spec Rack::MockRequest.env_for("/", "HTTP_HOST" => "www2.example.org:81") req.port.must_equal 81 + req = make_request \ + Rack::MockRequest.env_for("/", "HTTP_HOST" => "some_service:3001") + req.port.must_equal 3001 + req = make_request \ Rack::MockRequest.env_for("/", "SERVER_NAME" => "example.org", "SERVER_PORT" => "9292") req.port.must_equal 9292