[Buildroot] [PATCH-2020.02.x] package/ruby: add upstream security fix for CVE-2020-25613

[Buildroot] [PATCH-2020.02.x] package/ruby: add upstream security fix for CVE-2020-25613

[Peter Korsgaard]

For details, see the advisory:
https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 ...ore-strict-to-interpret-some-headers.patch | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 package/ruby/0001-Make-it-more-strict-to-interpret-some-headers.patch

diff --git a/package/ruby/0001-Make-it-more-strict-to-interpret-some-headers.patch b/package/ruby/0001-Make-it-more-strict-to-interpret-some-headers.patch
new file mode 100644
index 0000000000..f76de95ff5
--- /dev/null
+++ b/package/ruby/0001-Make-it-more-strict-to-interpret-some-headers.patch
@@ -0,0 +1,43 @@
+From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001
+From: Yusuke Endoh <mame@ruby-lang.org>
+Date: Tue, 29 Sep 2020 13:15:58 +0900
+Subject: [PATCH] Make it more strict to interpret some headers
+
+Some regexps were too tolerant.
+
+[Peter: fixes CVE-2020-25613, upstream:
+ https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7
+]
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ lib/webrick/httprequest.rb | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb
+index 294bd91..d34eac7 100644
+--- a/lib/webrick/httprequest.rb
++++ b/lib/webrick/httprequest.rb
+@@ -227,9 +227,9 @@ module WEBrick
+         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
+       end
+ 
+-      if /close/io =~ self["connection"]
++      if /\Aclose\z/io =~ self["connection"]
+         @keep_alive = false
+-      elsif /keep-alive/io =~ self["connection"]
++      elsif /\Akeep-alive\z/io =~ self["connection"]
+         @keep_alive = true
+       elsif @http_version < "1.1"
+         @keep_alive = false
+@@ -508,7 +508,7 @@ module WEBrick
+       return unless socket
+       if tc = self['transfer-encoding']
+         case tc
+-        when /chunked/io then read_chunked(socket, block)
++        when /\Achunked\z/io then read_chunked(socket, block)
+         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
+         end
+       elsif self['content-length'] || @remaining_size
+-- 
+2.20.1
+
-- 
2.20.1

[Buildroot] [PATCH-2020.02.x] package/ruby: add upstream security fix for CVE-2020-25613

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > For details, see the advisory:
 > https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2020.02.x and 2020.08.x, thanks.

-- 
Bye, Peter Korsgaard