[TBT-456] high vulnerability gems update

Gemfile

@@ -7,8 +7,9 @@ gem 'thwait'
 gem 'travis-conditions', git: 'https://github.com/travis-ci/travis-conditions'
 
 group :web do
-  gem 'puma', '~> 6.3.0'
-  gem 'sinatra', '~> 2'
+  gem 'puma', '~> 6.4', '>= 6.4.3'
+  gem 'rack', '>= 2.2.20'
+  gem 'sinatra', '~> 4.2'
   gem 'sinatra-contrib'
   gem 'rack-cors'
   gem 'rack-ssl-enforcer', '~> 0.2.9'
@@ -23,7 +24,7 @@ group :test do
   gem 'pry'
   gem 'rack-test'
   gem 'rake'
-  gem 'rexml'
+  gem 'rexml', '>= 3.3.9'
   gem 'rspec'
   gem 'webmock'
 end

Gemfile.lock

@@ -36,7 +36,7 @@ PATH
       faraday
       faraday_middleware
       memoyze (~> 0.0.1)
-      oj (~> 3.7.10)
+      oj (~> 3.13.0)
       regstry (~> 1.0.2)
       ruby-obj (~> 1.0.0)
       sh_vars (~> 1.0.0)
@@ -53,6 +53,7 @@ GEM
     atomic (1.1.101)
     avl_tree (1.2.1)
       atomic (~> 1.1)
+    base64 (0.3.0)
     bigdecimal (3.1.6)
     cl (1.2.4)
       regstry (~> 1.0.3)
@@ -92,6 +93,7 @@ GEM
     hitimes (1.3.1)
     json-schema (4.1.1)
       addressable (>= 2.8)
+    logger (1.7.0)
     memoyze (0.0.1)
     method_source (1.0.0)
     metriks (0.9.9.8)
@@ -104,32 +106,37 @@ GEM
       protocol (~> 2.0)
     multi_json (1.15.0)
     multipart-post (2.4.0)
-    mustermann (2.0.2)
+    mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    nio4r (2.7.0)
-    oj (3.7.12)
+    nio4r (2.7.5)
+    oj (3.13.23)
     parslet (1.8.2)
     protocol (2.0.0)
       ruby_parser (~> 3.0)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
     public_suffix (5.0.4)
-    puma (6.3.1)
+    puma (6.6.1)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (2.2.8.1)
+    rack (3.2.4)
     rack-cors (2.0.2)
       rack (>= 2.0.0)
-    rack-protection (2.2.4)
-      rack
+    rack-protection (4.2.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.1)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
     rack-ssl-enforcer (0.2.9)
     rack-test (2.1.0)
       rack (>= 1.3)
     rake (13.1.0)
     redcarpet (3.6.0)
     regstry (1.0.15)
-    rexml (3.2.6)
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -152,21 +159,23 @@ GEM
       faraday (>= 1.0)
     sexp_processor (4.17.1)
     sh_vars (1.0.2)
-    sinatra (2.2.4)
-      mustermann (~> 2.0)
-      rack (~> 2.2)
-      rack-protection (= 2.2.4)
+    sinatra (4.2.1)
+      logger (>= 1.6.0)
+      mustermann (~> 3.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.2.1)
+      rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (2.2.4)
-      multi_json
-      mustermann (~> 2.0)
-      rack-protection (= 2.2.4)
-      sinatra (= 2.2.4)
+    sinatra-contrib (4.2.1)
+      multi_json (>= 0.0.2)
+      mustermann (~> 3.0)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
       tilt (~> 2.0)
     sync (0.5.0)
     thwait (0.2.0)
       e2mmap
-    tilt (2.3.0)
+    tilt (2.6.1)
     tins (1.32.1)
       sync
     webmock (3.23.0)
@@ -175,6 +184,7 @@ GEM
       hashdiff (>= 0.4.0, < 2.0.0)
 
 PLATFORMS
+  arm64-darwin-21
   arm64-darwin-22
   x86_64-darwin-22
   x86_64-linux
@@ -183,16 +193,17 @@ DEPENDENCIES
   dpl!
   json-schema
   pry
-  puma (~> 6.3.0)
+  puma (~> 6.4, >= 6.4.3)
+  rack (>= 2.2.20)
   rack-cors
   rack-ssl-enforcer (~> 0.2.9)
   rack-test
   rake
   redcarpet
-  rexml
+  rexml (>= 3.3.9)
   rspec
   sentry-raven (~> 3.1.2)
-  sinatra (~> 2)
+  sinatra (~> 4.2)
   sinatra-contrib
   thwait
   travis-conditions!

lib/travis/yml/web/configs.rb

@@ -14,6 +14,9 @@ class Configs < Sinatra::Base
         post '/configs' do
           status 200
           json configs.to_h
+        rescue JSON::ParserError => e
+          # Treat JSON parser errors as encoding errors for backward compatibility
+          error(EncodingError.new(e.message))
         rescue Yml::Error, Oj::Error, EncodingError => e
           error e
         end

lib/travis/yml/web/expand.rb

@@ -20,6 +20,10 @@ class Expand < Sinatra::Base
           def handle
             status 200
             json matrix: expand
+          rescue JSON::ParserError => e
+            status 400
+            # Treat JSON parser errors as encoding errors for backward compatibility
+            error(EncodingError.new(e.message))
           rescue Oj::Error, EncodingError => e
             status 400
             error(e)
@@ -33,9 +37,6 @@ def data
             Oj.load(request_body, symbol_keys: true, mode: :strict, empty_string: false)
           end
 
-          def request_body
-            request.body.read.tap { request.body.rewind }
-          end
       end
     end
   end

lib/travis/yml/web/helpers.rb

@@ -8,7 +8,8 @@ def not_found
         end
 
         def request_body
-          request.body.read.tap { request.body.rewind }
+          request.body.rewind
+          request.body.read
         end
 
         def request_headers

lib/travis/yml/web/parse.rb

@@ -24,6 +24,10 @@ class Parse < Sinatra::Base
           def handle
             status 200
             json Parse::Config.new(load).to_h
+          rescue JSON::ParserError => e
+            # Treat JSON parser errors as input errors for backward compatibility
+            status 400
+            error(Yml::InputError.new(:invalid_config_format, e.message))
           rescue Yml::InputError => e
             status 400
             error(e)

travis-yml.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.require_path = 'lib'
 
   s.add_dependency 'amatch', '~> 0.4.0'
-  s.add_dependency 'oj', '~> 3.7.10'
+  s.add_dependency 'oj', '~> 3.13.0'
   s.add_dependency 'ruby-obj', '~> 1.0.0'
   s.add_dependency 'memoyze', '~> 0.0.1'
   s.add_dependency 'regstry', '~> 1.0.2'