Add CVE-2018-16471 for rack (#369)

Add CVE-2018-16471 for rack

Author: feelepxyz

gems/rack/CVE-2018-16471.yml

@@ -0,0 +1,80 @@
+---
+gem: rack
+cve: 2018-16471
+url: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
+title: Possible XSS vulnerability in Rack
+date: 2018-11-05
+
+description: |
+  There is a possible vulnerability in Rack. This vulnerability has been
+  assigned the CVE identifier CVE-2018-16471.
+
+  Versions Affected:  All.
+  Not affected:       None.
+  Fixed Versions:     2.0.6, 1.6.11
+
+  Impact
+  ------
+  There is a possible XSS vulnerability in Rack.  Carefully crafted requests can
+  impact the data returned by the `scheme` method on `Rack::Request`.
+  Applications that expect the scheme to be limited to "http" or "https" and do
+  not escape the return value could be vulnerable to an XSS attack.
+
+  Vulnerable code looks something like this:
+
+  ```
+  <%= request.scheme.html_safe %>
+  ```
+
+  Note that applications using the normal escaping mechanisms provided by Rails
+  may not impacted, but applications that bypass the escaping mechanisms, or do
+  not use them may be vulnerable.
+
+  All users running an affected release should either upgrade or use one of the
+  workarounds immediately.
+
+  Releases
+  --------
+  The 2.0.6 and 1.6.11 releases are available at the normal locations.
+
+  Workarounds
+  -----------
+  The following monkey patch can be applied to work around this issue:
+
+  ```
+  require "rack"
+  require "rack/request"
+
+  class Rack::Request
+  SCHEME_WHITELIST = %w(https http).freeze
+
+  def scheme
+    if get_header(Rack::HTTPS) == 'on'
+      'https'
+    elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'
+      'https'
+    elsif forwarded_scheme
+      forwarded_scheme
+    else
+      get_header(Rack::RACK_URL_SCHEME)
+    end
+  end
+
+  def forwarded_scheme
+    scheme_headers = [
+      get_header(HTTP_X_FORWARDED_SCHEME),
+      get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]
+    ]
+
+    scheme_headers.each do |header|
+      return header if SCHEME_WHITELIST.include?(header)
+    end
+
+    nil
+  end
+  end
+  ```
+
+patched_versions:
+  - "~> 1.6.11"
+  - ">= 2.0.6"