Bumps rack-protection from 1.5.3 to 1.5.5. This update includes security fixes.
Vulnerabilities fixed
> **Path traversal is possible via backslash characters on Windows.**
> An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
> is possible via backslash characters.
>
> Patched versions: [">= 2.0.1", "~> 1.5.4"]
> Unaffected versions: []
Commits
- [`a81e964`](https://github.com/sinatra/rack-protection/commit/a81e964e840c064c1a37b0dd165d7d5d8d5759bc) bump version to 1.5.5
- [`06f1b5d`](https://github.com/sinatra/rack-protection/commit/06f1b5d1bb00d81ebbad25414fb74f5bb9397c2f) Use secure_compare when checking CSRF token
- [`aecb5ea`](https://github.com/sinatra/rack-protection/commit/aecb5eab0f3504c15fbef9809b14c9243d04da6f) bump version to 1.5.4 (part2)
- [`922140a`](https://github.com/sinatra/rack-protection/commit/922140a29499ccd5c8bb8f1b399f6b13c80fedec) bump version to 1.5.3
- [`3cd3915`](https://github.com/sinatra/rack-protection/commit/3cd39153f1af4889428524ec0c7ad877728c7c92) Merge pull request [#120](https://github-redirect.dependabot.com/rkh/rack-protection/issues/120) from sinatra/backport-cve-2018-7212
- [`4239c2f`](https://github.com/sinatra/rack-protection/commit/4239c2f189a73dfc93e957fc97adcbcbc0ed31c6) enhanced path validation in Windows
- See full diff in [compare view](https://github.com/rkh/rack-protection/compare/v1.5.3...v1.5.5)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot ignore this [minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use [this|these] label[s]` will set the current labels as the default for future PRs for this repo and language
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Out-of-range updates (receive only lockfile updates, if desired)
Finally, you can contact us by mentioning @dependabot.
Bumps rack-protection from 1.5.3 to 1.5.5. This update includes security fixes.
Vulnerabilities fixed
> **Path traversal is possible via backslash characters on Windows.** > An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal > is possible via backslash characters. > > Patched versions: [">= 2.0.1", "~> 1.5.4"] > Unaffected versions: []Commits
- [`a81e964`](https://github.com/sinatra/rack-protection/commit/a81e964e840c064c1a37b0dd165d7d5d8d5759bc) bump version to 1.5.5 - [`06f1b5d`](https://github.com/sinatra/rack-protection/commit/06f1b5d1bb00d81ebbad25414fb74f5bb9397c2f) Use secure_compare when checking CSRF token - [`aecb5ea`](https://github.com/sinatra/rack-protection/commit/aecb5eab0f3504c15fbef9809b14c9243d04da6f) bump version to 1.5.4 (part2) - [`922140a`](https://github.com/sinatra/rack-protection/commit/922140a29499ccd5c8bb8f1b399f6b13c80fedec) bump version to 1.5.3 - [`3cd3915`](https://github.com/sinatra/rack-protection/commit/3cd39153f1af4889428524ec0c7ad877728c7c92) Merge pull request [#120](https://github-redirect.dependabot.com/rkh/rack-protection/issues/120) from sinatra/backport-cve-2018-7212 - [`4239c2f`](https://github.com/sinatra/rack-protection/commit/4239c2f189a73dfc93e957fc97adcbcbc0ed31c6) enhanced path validation in Windows - See full diff in [compare view](https://github.com/rkh/rack-protection/compare/v1.5.3...v1.5.5)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot ignore this [minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use [this|these] label[s]` will set the current labels as the default for future PRs for this repo and language Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) Finally, you can contact us by mentioning @dependabot.