File _service:tar_scm:Fix-CVE-2024-25126.patch of Package rubygem-rack

File _service:tar_scm:Fix-CVE-2024-25126.patch of Package rubygem-rack (Revision f834203a970c35df96458877bb0438d1)

Currently displaying revision f834203a970c35df96458877bb0438d1 , Show latest

From d9c163a443b8cadf4711d84bd2c58cb9ef89cf49 Mon Sep 17 00:00:00 2001
From: Jean Boussier <jean.boussier@gmail.com>
Date: Wed, 6 Dec 2023 18:32:19 +0100
Subject: [PATCH] Avoid 2nd degree polynomial regexp in MediaType

---
 lib/rack/media_type.rb | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/rack/media_type.rb b/lib/rack/media_type.rb
index 41937c99..7fc1e39d 100644
--- a/lib/rack/media_type.rb
+++ b/lib/rack/media_type.rb
@@ -4,7 +4,7 @@ module Rack
   # Rack::MediaType parse media type and parameters out of content_type string
 
   class MediaType
-    SPLIT_PATTERN = %r{\s*[;,]\s*}
+    SPLIT_PATTERN = /[;,]/
 
     class << self
       # The media type (type/subtype) portion of the CONTENT_TYPE header
@@ -15,7 +15,11 @@ module Rack
       # http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7
       def type(content_type)
         return nil unless content_type
-        content_type.split(SPLIT_PATTERN, 2).first.tap &:downcase!
+        if type = content_type.split(SPLIT_PATTERN, 2).first
+          type.rstrip!
+          type.downcase!
+          type
+        end
       end
 
       # The media type parameters provided in CONTENT_TYPE as a Hash, or
@@ -27,9 +31,10 @@ module Rack
         return {} if content_type.nil?
 
         content_type.split(SPLIT_PATTERN)[1..-1].each_with_object({}) do |s, hsh|
+          s.strip!
           k, v = s.split('=', 2)
-
-          hsh[k.tap(&:downcase!)] = strip_doublequotes(v)
+          k.downcase!
+          hsh[k] = strip_doublequotes(v)
         end
       end
 
-- 
2.25.1