🚨 [security] Update websocket-driver 0.7.0 → 0.8.2 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ websocket-driver (indirect, 0.7.0 → 0.8.2) · Repo · Changelog

Security Advisories 🚨

🚨 websocket-driver-ruby: Denial of service via malformed Host header

Impact

If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server() method, then a client can cause the server to crash by sending a Host header that is not a valid host[:port] string. When this happens, a URI::InvalidURIError exception is raised which is not caught, and this can cause the server process to crash if the application does not catch the error from the parse() method itself.

Patches

The issue has been patched in version 0.8.2 by making the request parser catch URI::InvalidURIError and enter an error state if the Host header is malformed. This means the request is considered invalid and should not establish a WebSocket connection.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

🚨 websocket-driver: Memory exhaustion via abuse of protocol length headers

Impact

The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a server or client can make the other peer parse these bytes into an ever-growing integer. Since Ruby integers are arbitrary precision, this can be used to make a WebSocket connection consume an unbounded amount of memory and lead to the host process running out of memory.

Patches

The issue has been patched in version 0.8.1. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

🚨 websocket-driver: Resource limit bypass via message compression

Impact

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

Patches

The issue has been patched in version 0.8.1, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

🚨 websocket-driver: Memory exhaustion in HTTP header parser

Impact

If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server or framework) using the WebSocket::Driver.server() method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory.

Patches

The issue has been patched in version 0.8.1, by limiting the total size of HTTP request/response lines and headers accepted by the parser to 32 kB. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

Release Notes

0.8.2 (from changelog)

• Gracefully handle malformed Host headers in the Server driver

0.8.1 (from changelog)

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing
• Limit the total HTTP request line and headers size to 32K

0.8.0 (from changelog)

• Emit binary message as a string with Encoding::BINARY instead of an array
• Add the option :binary_data_format to force the previous behaviour

0.7.7 (from changelog)

• Add base64 gem to the dependencies to support Ruby 3.4

0.7.6 (from changelog)

• Fix handling of default ports in Host headers on Ruby 3.1+

0.7.5 (from changelog)

• Do not change the encoding of strings passed to Driver#text

0.7.4 (from changelog)

• Optimise conversions between strings and byte arrays and related encoding operations, to reduce amount of allocation and copying

0.7.3 (from changelog)

• Let the client accept HTTP responses that have an empty reason phrase following the 101 status code

0.7.2 (from changelog)

• Emit ping and pong events from the Server driver
• Handle draft-76 handshakes correctly if the request's body is a frozen string

0.7.1 (from changelog)

• Catch any exceptions produced while generating a handshake response and send a 400 Bad Request response to the client
• Pick the RFC-6455 protocol version if the request contains any of the headers used by that version
• Handle errors encountered while handling malformed draft-76 requests

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 69 commits:

• Bump version to 0.8.2
• Gracefully handle malformed `Host` headers in the `Server` driver
• Bump version to 0.8.1
• Limit the total HTTP request line and headers size to 32K
• Fail the connection if a message is larger than the configured max length after extension processing
• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Test on Ruby 4.0
• Update release date for 0.8.0
• Prefer text frames over binary; if the input is in some non-UTF-8 text encoding, then transcode it
• Bump version to 0.8.0
• Default to text frames if the input buffer is specifically UTF8-encoded
• Remove Ruby versions unsupported by GitHub
• Move the changelog_uri closer to other similar metadata
• Merge pull request #93 from mark-young-atg/provide_changelog_link_on_rubygems
• Update the documentation for representation of binary messages
• Emit binary frames as binary strings by default, and make Driver.frame() treat such strings as binary frames
• Merge pull request #95 from mackuba/binary_format
• added :binary_data_format option
• Provide a 'Changelog' link on rubygems.org/gems/websocker-driver
• Bump version to 0.7.7
• Test on Ruby 3.3 and 3.4
• Merge pull request #91 from HoneyryderChuck/patch-1
• add base64 gem to gemspec
• Run tests on some additional Ruby versions
• Bump version to 0.7.6
• Test on Ruby 3.2
• Fix handling of default ports on Ruby 3.1
• Run tests on Ruby 3.1
• Merge pull request #85 from danielmorrison/support-frozen-by-default
• Remove implied wss support from the TCPSocket example
• Flag files that modify string literals
• Bump version to 0.7.5
• Clarify behaviour of Driver.encode to convert strings to UTF-8 and arrays to ASCII-8BIT
• Do not change the encoding of strings passed to text()
• Bump version to 0.7.4
• Switch from Travis CI to GitHub Actions
• Enable Bundler caching for Travis
• Merge pull request #75 from matti/patch-1
• Validate UTF-8 encoding of strings where needed, not on every call to Driver.encode
• Avoid allocating an array of the string bytes in Hybi#emit_frame
• Avoid allocating so many arrays during Hybi#frame
• Use the Ruby Encoding constants instead of their string names
• Update Ruby versions on Travis
• Merge pull request #77 from timcraft/patch-1
• Test on ruby 3.0
• Bump version to 0.7.3
• Accept HTTP responses that have an empty reason-phrase, per RFC 2616
• README: example of http response
• Bump version to 0.7.2
• Set {source,target}_version to work with the current version of javac on macOS
• Update Ruby versions 2.4 to 2.7 on Travis
• Allow rack.input.read to return a frozen string
• Emit ping and pong events from the Server driver
• Mention license change in the changelog
• Formatting change: {...} should have spaces inside the braces
• Bump version to 0.7.1
• Change markdown formatting of docs.
• Remove a redundant statement from the Hybi setup code.
• Fail a draft-76 connection of a header does not contain any digits.
• Depend on Rake < 12.3 if we're running on Ruby < 2.0.
• Reformat the C and Java native extension modules.
• Fix an uninitialised variable warning.
• Update Travis target versions.
• Switch license to Apache 2.0.
• Test on Ruby 2.5.0.
• I think you have to use jruby-head instead of jruby-9 now.
• Bump the Ruby versions for Travis.
• If any header used by Hybi is present, then pick Hybi, and likewise for Draft76. This means the driver is more likely to pick Hybi and report likely combinations of malformed headers as errors to the client.
• If any driver encounters a validation error in the request headers, it can throw an error and Driver#start will catch that and send a 400 response to the client.

↗️ websocket-extensions (indirect, 0.1.3 → 0.1.5) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service in websocket-extensions (RubyGem)

Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:

Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.

Patches

Users should upgrade to version 0.1.5.

Workarounds

There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.

References

• https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/

Release Notes

0.1.5 (from changelog)

• Remove a ReDoS vulnerability in the header parser (CVE-2020-7663)

0.1.4 (from changelog)

• Fix a deprecation warning for using the =~ operator on true

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 13 commits:

• Bump version to 0.1.5
• Remove ReDoS vulnerability in the Sec-WebSocket-Extensions header parser
• Test on JRuby 9.{0,1,2} rather than "head"
• Update Ruby versions 2.4 to 2.7 on Travis
• Mention license change in the changelog
• Formatting change: {...} should have spaces inside the braces
• Bump version to 0.1.4
• Change markdown formatting of docs.
• Fix deprecation warning about =~ being called on TrueClass.
• Fix RSpec warnings about raise_error with no arguments.
• Update Travis target versions.
• Switch license to Apache 2.0.
• Test on Ruby 2.5.0.

🆕 base64 (added, 0.3.0)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)