P20-1753: Bump rack from 2.2.9 to 2.2.21

[artem-vavilov]

Fixes:

• https://github.com/code-dot-org/code-dot-org/security/dependabot/886
• https://github.com/code-dot-org/code-dot-org/security/dependabot/981
• https://github.com/code-dot-org/code-dot-org/security/dependabot/979
• https://github.com/code-dot-org/code-dot-org/security/dependabot/912
• https://github.com/code-dot-org/code-dot-org/security/dependabot/983
• https://github.com/code-dot-org/code-dot-org/security/dependabot/971
• https://github.com/code-dot-org/code-dot-org/security/dependabot/977

Links

• JIRA task: P20-1753

[Hamms]

Glancing through the changelog, I note that version 2.2.14 has a warning about potentially breaking existing applications "if query parameters exceed 4,096 in count or 4 MB in total size"

I certainly hope that's not the case for any of our routes, but are we able to definitively confirm that?

[artem-vavilov]

Glancing through the changelog, I note that version 2.2.14 has a warning about potentially breaking existing applications "if query parameters exceed 4,096 in count or 4 MB in total size"

I certainly hope that's not the case for any of our routes, but are we able to definitively confirm that?

The URL encoded parameter size limit (query string and form encoded POST parameters) is now 4,194,304 characters in the new Rack. This limit is enforced by Rack::QueryParser and does not apply to JSON request bodies (payload):

Rack::QueryParser::QueryLimitError: total query size exceeds limit (4194304)

In production, CloudFront enforces its own URL size limits and rejects requests whose URL (path plus query string) exceeds 8,192 bytes. As a result, requests with query strings larger than approximately 4,096 characters can be rejected by CloudFront with HTTP 413, independently of the Rack version or Rack query size limits:

• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorS3Origin.html#RequestS3MaxRequestStringLength
• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#:~:text=Maximum%20length%20of%20a%20URL

[sureshc]

Can we search our CloudFront http logs for querystring larger than a specific size? Those logs might truncate that field at a specific length. I'll try to research that today.

[Hamms]

Fantastic, thank you for digging into this! That CloudFront limit is exactly the kind of evidence I was looking for to be able to be confident that this change will not affect any existing functionality.

LGTM!