[Security] Bump rack from 1.4.1 to 1.6.11

[dependabot-preview]

Bumps rack from 1.4.1 to 1.6.11. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Potential Denial of Service Vulnerability in Rack
Carefully crafted requests can cause a SystemStackError and potentially
cause a denial of service attack.

All users running an affected release should upgrade.

Patched versions: >= 1.6.2; ~> 1.5.4; ~> 1.4.6
Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects rack
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

Affected versions: >= 1.4.0, < 1.4.2

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects rack
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

Affected versions: >= 1.4.0, < 1.4.3

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects rack
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Affected versions: >= 1.4.0, < 1.4.5

Sourced from The Ruby Advisory Database.

Possible XSS vulnerability in Rack
There is a possible vulnerability in Rack. This vulnerability has been
assigned the CVE identifier CVE-2018-16471.

Versions Affected: All.
Not affected: None.
Fixed Versions: 2.0.6, 1.6.11

Impact

There is a possible XSS vulnerability in Rack. Carefully crafted requests can
impact the data returned by the scheme method on Rack::Request.
Applications that expect the scheme to be limited to "http" or "https" and do
not escape the return value could be vulnerable to an XSS attack.

Vulnerable code looks something like this:

<%= request.scheme.html_safe %>

... (truncated)

Patched versions: ~> 1.6.11; >= 2.0.6
Unaffected versions: none

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog

[Unreleased]

Added

• CHANGELOG.md using keep a changelog formatting by @​twitnithegirl

Changed

• Rack::Utils.status_code now raises an error when the status symbol is invalid instead of 500.
• Rack::Request::SCHEME_WHITELIST has been renamed to Rack::Request::ALLOWED_SCHEMES
• Rack::Multipart::Parser.get_filename now accepts file that contains + in its name, avoiding the replacement of + to space character since filenames with + are valid.

Removed

• HISTORY.md by @​twitnithegirl
• NEWS.md by @​twitnithegirl

History/News Archive

Items below this line are from the previously maintained HISTORY.md and NEWS.md files.

[2.0.0]

• Rack::Session::Abstract::ID is deprecated. Please change to use Rack::Session::Abstract::Persisted

[2.0.0.alpha] 2015-12-04

• First-party "SameSite" cookies. Browsers omit SameSite cookies from third-party requests, closing the door on many CSRF attacks.
• Pass same_site: true (or :strict) to enable: response.set_cookie 'foo', value: 'bar', same_site: true or same_site: :lax to use Lax enforcement: response.set_cookie 'foo', value: 'bar', same_site: :lax
• Based on version 7 of the Same-site Cookies internet draft:
  https://tools.ietf.org/html/draft-west-first-party-cookies-07
• Thanks to Ben Toews (@​mastahyeti) and Bob Long (@​bobjflong) for updating to drafts 5 and 7.
• Add Rack::Events middleware for adding event based middleware: middleware that does not care about the response body, but only cares about doing work at particular points in the request / response lifecycle.
• Add Rack::Request#authority to calculate the authority under which the response is being made (this will be handy for h2 pushes).
• Add Rack::Response::Helpers#cache_control and cache_control=. Use this for setting cache control headers on your response objects.
• Add Rack::Response::Helpers#etag and etag=. Use this for setting etag values on the response.
• Introduce Rack::Response::Helpers#add_header to add a value to a multi-valued response header. Implemented in terms of other Response#*_header methods, so it's available to any response-like class that includes the Helpers module.
• Add Rack::Request#add_header to match.
• Rack::Session::Abstract::ID IS DEPRECATED. Please switch to Rack::Session::Abstract::Persisted. Rack::Session::Abstract::Persisted uses a request object rather than the env hash.
• Pull ENV access inside the request object in to a module. This will help with legacy Request objects that are ENV based but don't want to inherit from Rack::Request
• Move most methods on the Rack::Request to a module Rack::Request::Helpers and use public API to get values from the request object. This enables users to mix Rack::Request::Helpers in to their own objects so they can implement (get|set|fetch|each)_header as they see fit (for example a proxy object).
• Files and directories with + in the name are served correctly. Rather than unescaping paths like a form, we unescape with a URI parser using Rack::Utils.unescape_path. Fixes #265
• Tempfiles are automatically closed in the case that there were too
  many posted.
• Added methods for manipulating response headers that don't assume
  they're stored as a Hash. Response-like classes may include the
  Rack::Response::Helpers module if they define these methods:
  • Rack::Response#has_header?
  • Rack::Response#get_header
  • Rack::Response#set_header

... (truncated)

Commits

• 2bef132 Bumping version for release
• 97ca63d Whitelist http/https schemes
• 7b5054e Merge pull request #1296 from tomelm/fix-prefers-plaintext
• fdcd03a Bump version for release
• 2293c6a Merge pull request #1249 from mclark/handle-invalid-method-parameters
• b27dd86 handle failure to upcase invalid strings
• 274d934 Stick with a passing version of Rubygems and bundler
• 617aac0 bump version for release
• dc017e7 Merge pull request #1237 from eileencodes/backport-1137
• 4d6965a Backport pull request #1137 from unabridged/fix-eof-failure
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #17.