actionpack 3.0.8 → 3.0.9.rc1

data/CHANGELOG

@@ -1,7 +1,36 @@
-*Rails 3.0.8 (unreleased)*
+*Rails 3.0.9 (unreleased)*
+
+* Fix text helpers to work correctly with the new SafeBuffer restriction [Paul Gallagher, Arun Agrawal, Prem Sichanugrist]
+
+
+*Rails 3.0.8 (June 7, 2011)*
+
+* It is prohibited to perform a in-place SafeBuffer mutation [tenderlove]
+
+  The old behavior of SafeBuffer allowed you to mutate string in place via
+  method like `sub!`. These methods can add unsafe strings to a safe buffer,
+  and the safe buffer will continue to be marked as safe.
+
+  An example problem would be something like this:
+
+    <%= link_to('hello world', @user).sub!(/hello/, params[:xss])  %>
+
+  In the above example, an untrusted string (`params[:xss]`) is added to the
+  safe buffer returned by `link_to`, and the untrusted content is successfully
+  sent to the client without being escaped.  To prevent this from happening
+  `sub!` and other similar methods will now raise an exception when they are called on a safe buffer.
+
+  In addition to the in-place versions, some of the versions of these methods which return a copy of the string will incorrectly mark strings as safe. For example:
+
+     <%= link_to('hello world', @user).sub(/hello/, params[:xss]) %>
+
+  The new versions will now ensure that *all* strings returned by these methods on safe buffers are marked unsafe.
+
+  You can read more about this change in http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2e516e7acc96c4fb
 
 * Fixed github issue #342 with asset paths and relative roots.
 
+
 *Rails 3.0.7 (April 18, 2011)*
 
 *No changes.

data/lib/action_pack/version.rb

@@ -2,8 +2,8 @@ module ActionPack
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 0
-    TINY  = 8
-    PRE   = nil
+    TINY  = 9
+    PRE   = "rc1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
   end

data/lib/action_view/helpers/cache_helper.rb

@@ -53,7 +53,13 @@ module ActionView
           # This dance is needed because Builder can't use capture
           pos = output_buffer.length
           yield
-          fragment = output_buffer.slice!(pos..-1)
+          if output_buffer.is_a?(ActionView::OutputBuffer)
+            safe_output_buffer = output_buffer.to_str
+            fragment = safe_output_buffer.slice!(pos..-1)
+            self.output_buffer = ActionView::OutputBuffer.new(safe_output_buffer)
+          else
+            fragment = output_buffer.slice!(pos..-1)
+          end
           controller.write_fragment(name, fragment, options)
         end
       end

data/lib/action_view/helpers/javascript_helper.rb

@@ -49,7 +49,7 @@ module ActionView
       # Escape carrier returns and single and double quotes for JavaScript segments.
       def escape_javascript(javascript)
         if javascript
-          javascript.gsub(/(\\|<\/|\r\n|[\n\r"'])/) { JS_ESCAPE_MAP[$1] }
+          javascript.gsub(/(\\|<\/|\r\n|[\n\r"'])/) {|match| JS_ESCAPE_MAP[match] }
         else
           ''
         end

data/lib/action_view/helpers/url_helper.rb

@@ -483,7 +483,7 @@ module ActionView
         extras << "subject=#{Rack::Utils.escape(subject).gsub("+", "%20")}" unless subject.nil?
         extras = extras.empty? ? '' : '?' + html_escape(extras.join('&'))
 
-        email_address_obfuscated = email_address.dup
+        email_address_obfuscated = email_address.to_str
         email_address_obfuscated.gsub!(/@/, html_options.delete("replace_at")) if html_options.has_key?("replace_at")
         email_address_obfuscated.gsub!(/\./, html_options.delete("replace_dot")) if html_options.has_key?("replace_dot")
 

metadata

@@ -1,13 +1,15 @@
 --- !ruby/object:Gem::Specification 
 name: actionpack
 version: !ruby/object:Gem::Version 
-  hash: 23
-  prerelease: 
+  hash: 15424063
+  prerelease: 6
   segments: 
   - 3
   - 0
-  - 8
-  version: 3.0.8
+  - 9
+  - rc
+  - 1
+  version: 3.0.9.rc1
 platform: ruby
 authors: 
 - David Heinemeier Hansson
@@ -15,7 +17,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-06-07 00:00:00 Z
+date: 2011-06-08 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: activesupport
@@ -25,12 +27,14 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        hash: 23
+        hash: 15424063
         segments: 
         - 3
         - 0
-        - 8
-        version: 3.0.8
+        - 9
+        - rc
+        - 1
+        version: 3.0.9.rc1
   type: :runtime
   version_requirements: *id001
 - !ruby/object:Gem::Dependency 
@@ -41,12 +45,14 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        hash: 23
+        hash: 15424063
         segments: 
         - 3
         - 0
-        - 8
-        version: 3.0.8
+        - 9
+        - rc
+        - 1
+        version: 3.0.9.rc1
   type: :runtime
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
@@ -356,12 +362,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
 required_rubygems_version: !ruby/object:Gem::Requirement 
   none: false
   requirements: 
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version 
-      hash: 3
+      hash: 25
       segments: 
-      - 0
-      version: "0"
+      - 1
+      - 3
+      - 1
+      version: 1.3.1
 requirements: 
 - none
 rubyforge_project: actionpack