PATCH: Compatibility macros for Ruby 1.8.5

The CGI multipart issue is definitely fixed in all Red Hat-provided Ruby packages for RHEL:

http://rhn.redhat.com/errata/RHSA-2006-0729.html

I'm trying to think of a way that this could be handled, given that a check for a fixed version number (1.8.5 or 1.8.6) in the gem is not enough to determine whether there actually is a vulnerability.

I see no other way then looking at the Ruby version number (apply of < 1.8.6).

I don't think it you cause any trouble if we require the gem even if the Ruby version was already patched.

Let me know if you got a better solution.

Yeah, I'm trying to think of one... but nothing springs to mind just yet. Brainstorming here: leave it up to the user to install the gem if they need it? print a warning at startup if Thin thinks the gem might be needed but it's not present on the system? provide a config file override to silence the warning if the user is sure that it's not a problem?

I guess it's up to you whether you think that kind of effort is worth it to avoid the overhead of loading an unneeded gem; personally, I don't really like the idea of overwriting code like that unless it's necessary. Strikes me as being a bit brittle.

Looking at the Gem source:

http://mongrel.rubyforge.org/browser/trunk/projects/cgi_multipart_e...

It basically looks like they just overwrite the original method with a fixed one. (I notice that they conditionally check for JRuby in the RUBY_PLATFORM variable; I don't know whether it would be worth doing a similar check for RHEL.)

For comparison, here is the patch that Red Hat already includes with their Ruby packages:

https://bugzilla.redhat.com/attachment.cgi?id=142732

Well, I think you're solution is probably fine. Those of us who have a patched version of 1.8.5 like me can just ignore the warning in the log.

(Not sure if commenting will re-open the ticket... just wanted to say it looks good.)