rubygem-puma/CVE-2022-23634.patch
2023-12-20 10:01:15 +08:00

48 lines
1.3 KiB
Diff

From b70f451fe8abc0cff192c065d549778452e155bb Mon Sep 17 00:00:00 2001
From: Jean Boussier <jean.boussier@gmail.com>
Date: Fri, 11 Feb 2022 15:58:08 +0100
Subject: [PATCH] Ensure `close` is called on the response body no matter
what
Another fallout from https://github.com/puma/puma/pull/2809 is that
in some cases the `res_body.close` wasn't called because some previous
code
raised.
For Rails apps it means CurrentAttributes and a few other important
states aren't reset properly.
This is being improved on the Rails side too, but I believe it would
be good to harden this on the puma side as well.
---
lib/puma/server.rb | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/lib/puma/server.rb b/lib/puma/server.rb
index 4ce0c74..7871c91 100644
--- a/lib/puma/server.rb
+++ b/lib/puma/server.rb
@@ -866,11 +866,14 @@ module Puma
end
ensure
- uncork_socket client
+ begin
+ uncork_socket client
- body.close
- req.tempfile.unlink if req.tempfile
- res_body.close if res_body.respond_to? :close
+ body.close
+ req.tempfile.unlink if req.tempfile
+ ensure
+ res_body.close if res_body.respond_to? :close
+ end
after_reply.each { |o| o.call }
end
--
2.30.0