WEBrick: prevent response splitting and header injection

Origin: https://github.com/ruby/ruby/commit/3ce238b5f9795581eb84114dcfbdf4aa086bfecc
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-16254

This is a follow up to d9d4a28f1cdd05a0e8dabb36d747d40bbcc30f16.
The commit prevented CRLR, but did not address an isolated CR or an
isolated LF.

Co-Authored-By: NARUSE, Yui <naruse@airemix.jp>
[Salvatore Bonaccorso: Backport to 2.3.3:
 - Context changes in test/webrick/test_httpresponse.rb
]

Gbp-Pq: Name WEBrick-prevent-response-splitting-and-header-inject.patch

Loop with String#scan without creating substrings

Origin: https://github.com/ruby/ruby/commit/36e057e26ef2104bc2349799d6c52d22bb1c7d03
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-16201

Create the substrings necessary parts only, instead of cutting the
rest of the buffer.  Also removed a useless, probable typo, regexp.

Gbp-Pq: Name Loop-with-String-scan-without-creating-substrings.patch

Fix for wrong fnmatch patttern

Origin: https://github.com/ruby/ruby/commit/a0a2640b398cffd351f87d3f6243103add66575b
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-15845

* dir.c (file_s_fnmatch): ensure that pattern does not contain a
  NUL character.  https://hackerone.com/reports/449617

Gbp-Pq: Name Fix-for-wrong-fnmatch-patttern.patch

CVE-2019-8320-25

Backport of https://github.com/rubygems/rubygems/commit/56c0bbb69e4506bda7ef7f447dfec5db820df20b

Backport of https://github.com/rubygems/rubygems/commit/56c0bbb69e4506bda7ef7f447dfec5db820df20b
addressing, thanks to Leonidas S. Barbosa

CVE-2019-8320
CVE-2019-8321
CVE-2019-8322
CVE-2019-8323
CVE-2019-8324
CVE-2019-8325

Gbp-Pq: Name CVE-2019-8320-25.patch

debian-changes

This patch file represents the entire difference between the package as shipped
by Debian and the official upstream sources. The goal is to maintain this file
as small as possible, avoiding non-upstreamed patches at all costs.

The Debian packaging is maintained in the following Git repository:

  http://anonscm.debian.org/gitweb/?p=collab-maint/ruby.git

To obtain a view of the individual commits that affect non-Debian-specific
files, you can clone that repository, and from the master branch, run:

  $ ./debian/upstream-changes

Gbp-Pq: Name debian-changes

ruby2.3 (2.3.3-1+deb9u8) stretch; urgency=high

  * Non-maintainer upload.
  * Add patch to fix unsafe object creation vulnerability.
    (Fixes: CVE-2020-10663)

[dgit import unpatched ruby2.3 2.3.3-1+deb9u8]

Import ruby2.3_2.3.3-1+deb9u8.debian.tar.xz

[dgit import tarball ruby2.3 2.3.3-1+deb9u8 ruby2.3_2.3.3-1+deb9u8.debian.tar.xz]

Import ruby2.3_2.3.3.orig.tar.xz

[dgit import orig ruby2.3_2.3.3.orig.tar.xz]