4.3.11, backport 5.6.2 (#2822)

puma · Feb 11, 2022 · 4ce94d7 · 4ce94d7
1 parent a62754e
commit 4ce94d7
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 5 deletions.
diff --git a/History.md b/History.md
@@ -1,3 +1,8 @@
+## 4.3.11 / 2022-02-11
+
+* Security
+  * Always close the response body (GHSA-rmj8-8hhh-gv5h)
+
 ## 4.3.10 / 2021-10-12
 
 * Bugfixes

diff --git a/lib/puma/const.rb b/lib/puma/const.rb
@@ -100,7 +100,7 @@ class UnsupportedOption < RuntimeError
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.10".freeze
+    PUMA_VERSION = VERSION = "4.3.11".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 

diff --git a/lib/puma/server.rb b/lib/puma/server.rb
@@ -873,11 +873,14 @@ def handle_request(req, lines)
         end
 
       ensure
-        uncork_socket client
+        begin
+          uncork_socket client
 
-        body.close
-        req.tempfile.unlink if req.tempfile
-        res_body.close if res_body.respond_to? :close
+          body.close
+          req.tempfile.unlink if req.tempfile
+        ensure
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end