-
Notifications
You must be signed in to change notification settings - Fork 122
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade Sinatra and Rack to fix vulnerability
The security alert says: > [sinatra is] vulnerable to Reliance on Untrusted Inputs in a Security > Decision via the X-Forwarded-Host (XFH) header. When making a request to > a method with redirect applied, it is possible to trigger an Open > Redirect Attack by inserting an arbitrary address into this header. If > used for caching purposes, such as with servers like Nginx, or as a > reverse proxy, without handling the X-Forwarded-Host header, attackers > can potentially exploit Cache Poisoning or Routing-based SSRF. See https://github.com/gma/nesta/security/dependabot/28 for details.
- Loading branch information
Showing
3 changed files
with
16 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@etc My pleasure. I suspect I could release 0.17.0 now, but after testing it on the effectif.com site (which works fine) I decided to go to the pub instead. I'll test another couple of real-world things first, then probably push .17 out.
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@etc Everything seems fine on the sites I've upgraded so far, so I've released 0.17.0
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pub should always take precedence! Thanks again for keeping all this updated.
One small note: this update breaks support for using thin as your server, if you want to maintain the other parts of your project at their latest versions. That's because the latest release of thin that is compatible with Nesta, now, is 1.6.2—but that version of thin doesn't work with the Ruby versions 2.4 and later, since it uses
::Fixnum(the error you get isuninitialized constant Thin::Server::Fixnum (NameError). No problem overall since it's easy to use another server, such as puma. But might be worth noting this in the documentation...f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@etc Ah that's a shame. I had a look, and it's explicitly marked as being incompatible with Rack 3 in its gemspec. That's a shame, but like you say, Puma to the rescue.
I've suggested Puma in the deployment docs, rather than mentioning thin explicitly. You never know, it might support Rack 3 before long. Looks like there's a pull request that's seen some activity.
gma/nestacms.com@b990288
Cheers for letting me know.
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great, thanks! Puma is working just fine, for me.
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice. I should probably add Puma to the default Gemfile.
I just documented Netlify, should you want to give static a go.
f0ff629There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's interesting, I might explore that in future if my hosting options change. At present I'm deploying on Railway, which I migrated to after Heroku ended their free plans (I was lucky enough to sign up on a free plan there before Railway, too, ended them). It works really nicely, with everything automatically re-building after every Github push.