File rubygem-rack-CVE-2022-30123.patch of Package rubygem-rack.32805
Index: rack-1.6.13/lib/rack/commonlogger.rb
===================================================================
--- rack-1.6.13.orig/lib/rack/commonlogger.rb
+++ rack-1.6.13/lib/rack/commonlogger.rb
@@ -54,6 +54,8 @@ module Rack
length,
now - began_at ]
+ msg.gsub!(/[^[:print:]\n]/) { |c| "\\x#{c.ord}" }
+
logger = @logger || env['rack.errors']
# Standard library logger doesn't support write but it supports << which actually
# calls to write on the log device without formatting