Crystal 1.22.3 is released!

Johannes Müller
API Docs Changelog Source

Highlights

We are announcing a new Crystal release 1.22.3 with important security patches, regression fixes, and normal bug fixes.

See the release notes of 1.22.0 for all the changes introduced in Crystal 1.22.

Pre-built packages are available on GitHub Releases and our official distribution channels. See crystal-lang.org/install for installation instructions.

Stats

This release includes 14 changes since 1.22.2 by 4 contributors. We thank all the contributors for all the effort put into improving the language! ❤️

Changes

Below we list the most significant, security-related changes. For more details, visit the full changelog.

Socket reliably enforces port number range

Creating a socket on port higher than 65535 can no longer succeed with a truncated port number (#17848). On some systems, the following snipped would create a socket on port 8080 prior to this patch:

TCPServer.new(73616).local_address # raises Socket::Addrinfo::Error

Thanks, @straight-shoota

HTTP message validation

We fixed a couple of bugs in the HTTP message parser which previously accepted some invalid inputs. This could potentially result in a protocol desync with a parser that interprets these invalid message in a different way.

  • control whitespace before field value in HTTP headers (#17903)
  • HTTP::ChunkedContent validates the chunk-line (#17898)
  • validate Content-Length header (#17902)

These invalid message now always result in an error.

Thanks, @ysbaddaden

HTTP Connection header

The close token in Connection header now always closes the connection, even if there are other values beside it (#17904).

Thanks, @ysbaddaden

IO::Delimited delimiter mismatch

Fix IO::Delimited matching after a fragmented delimiter mismatch (#17916).

Thanks, @ysbaddaden

Enum.parse? regression could lead to out-of-bounds writes and crash

Enum.parse? no longer crashes if the input exceeds max bytesize buffer limit (#17836). This is a regression from 1.22.0.

Thanks, @straight-shoota

Thanks

We have been able to do all of this thanks to the continued support of 84codes and all other sponsors. To maintain and increase the development pace, donations and sponsorships are essential. OpenCollective is available for that.

Reach out to crystal@manas.tech if you’d like to become a direct sponsor or find other ways to support Crystal. We thank you in advance!

Contribute