Lowercase response header keys for Rack 3 compatibility

[dkisselev]

Summary

• Lowercase response header keys in BlockPathTraversal middleware for Rack 3 compatibility (Rack 3 requires lowercase header keys)
• Bump version to 0.0.2

Test plan

• Verify middleware works with Rack 3 applications
• Verify backward compatibility with Rack 2

🤖 Generated with Claude Code

[dryrunsecurity]

This pull request contains a high-severity finding: the has_path_traversal? method in lib/rack-security-middleware/block_path_traversal.rb only replaces "%2e" with a dot and fails to normalize or properly decode paths, leaving it vulnerable to bypass via URL-encoded slashes, backslashes, double-encoding, and other encodings (e.g., ..%2f..%2fetc%2fpasswd or ..%5c..%5cwindows%5cwin.ini). Fixes should fully normalize and safely decode input paths (handle %2f, %5c, double-encoding, backslashes, etc.) before checking for traversal sequences.

🟠 Incomplete Path Traversal Filtering in lib/rack-security-middleware/block_path_traversal.rb (drs_bea85d7d)

Vulnerability

Incomplete Path Traversal Filtering

Description

The has_path_traversal? method in lib/rack-security-middleware/block_path_traversal.rb only performs a very limited sanitization by replacing %2e with a dot. This is insufficient to detect path traversal attempts using other encoding techniques, such as URL-encoded slashes (%2f, %5c), backslashes, or double URL encoding. Furthermore, it does not normalize the input path, which is critical for preventing bypasses in web applications that handle various path representations. An attacker can easily bypass this check using payloads like ..%2f..%2fetc%2fpasswd or ..%5c..%5cwindows%5cwin.ini, which the current implementation fails to identify.

rack-security-middleware/lib/rack-security-middleware/block_path_traversal.rb

Lines 9 to 15 in abef514

	def call(env)
	if has_path_traversal?(env['PATH_INFO'])
	[403, { 'content-type' => 'text/html' }, ['Forbidden']]
	else
	@app.call env
	end

---

All finding details can be found in the DryRun Security Dashboard.