From c917ac526df214611ec33c21de2b070452ec8434 Mon Sep 17 00:00:00 2001 From: Dirkjan Bussink Date: Mon, 8 Mar 2021 09:51:09 +0100 Subject: Allocate a new request for each client This removes the reuse of the parser between requests. Reusing these is risky in the context of running any other threads within the unicorn process, also for threads that run background tasks. If any other thread accidentally grabs hold of the request it can modify things for the next request in flight. The downside here is that we allocate more for each request, but that is worth the trade off here and the security risk we otherwise would carry to leaking wrong and incorrect data. --- lib/unicorn/oob_gc.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'lib/unicorn/oob_gc.rb') diff --git a/lib/unicorn/oob_gc.rb b/lib/unicorn/oob_gc.rb index 3b2f488..91a8e51 100644 --- a/lib/unicorn/oob_gc.rb +++ b/lib/unicorn/oob_gc.rb @@ -60,7 +60,6 @@ module Unicorn::OobGC self.const_set :OOBGC_INTERVAL, interval ObjectSpace.each_object(Unicorn::HttpServer) do |s| s.extend(self) - self.const_set :OOBGC_ENV, s.instance_variable_get(:@request).env end app # pretend to be Rack middleware since it was in the past end @@ -68,9 +67,10 @@ module Unicorn::OobGC #:stopdoc: def process_client(client) super(client) # Unicorn::HttpServer#process_client - if OOBGC_PATH =~ OOBGC_ENV['PATH_INFO'] && ((@@nr -= 1) <= 0) + env = instance_variable_get(:@request).env + if OOBGC_PATH =~ env['PATH_INFO'] && ((@@nr -= 1) <= 0) @@nr = OOBGC_INTERVAL - OOBGC_ENV.clear + env.clear disabled = GC.enable GC.start GC.disable if disabled -- cgit v1.2.3-24-ge0c7