actionpack 5.2.4.5 → 5.2.5

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 8458248b602da029b1e9113db9f0305888fdf99bf83ea4fe679ad0ed49b22175
4
- data.tar.gz: '085825f1ed9d286aa92cf5fa06fb039534331030d5b70da304c237a492f7ded9'
3
+ metadata.gz: 3b9466cc66aef89ae39a6f759279293fa180454f543f7149d1ab8de9ed9ae899
4
+ data.tar.gz: a72f72e877d142cc9c377615429190f6327fbd6d8e522f7ada200c30ec02bba8
5
5
  SHA512:
6
- metadata.gz: 7a6b62b3afeeb992a981128fbfab64944e897f20a0e75cbef6fd3d972108321ff440f7344935c8d196c1d1e6d3e08d64f040c6c5aa9ad63f06e9b78875da0c54
7
- data.tar.gz: 27a049710288451664d3672a6fb18fe505003d9bb91826408ab507d9de06fa9f1a877a2dfc6b9a9b91e32c0f122cdfd33b1bcd3802e64966e4388c17dcad08e6
6
+ metadata.gz: caf16e1e2886b217f359e358d24d6eb33e692f40165c96a324571b009ceb7d1b97df22320c2e320106aad26e4f7874db26790ba7cc4f61c9a6a21fae13f9e366
7
+ data.tar.gz: 30094a122031f1a4cff32d7cc0ad6fe4a14e318267e3cfea6ff85f9ca172f8b1f6677299634c776df580c4b3a44200e494fa06f6933821d4d5b8838d9a7a4815
data/CHANGELOG.md CHANGED
@@ -1,3 +1,8 @@
1
+ ## Rails 5.2.5 (March 26, 2021) ##
2
+
3
+ * No changes.
4
+
5
+
1
6
  ## Rails 5.2.4.5 (February 10, 2021) ##
2
7
 
3
8
  * No changes.
@@ -15,12 +20,22 @@
15
20
  * [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
16
21
 
17
22
 
23
+ ## Rails 5.2.4.2 (March 19, 2020) ##
24
+
25
+ * No changes.
26
+
27
+
18
28
  ## Rails 5.2.4.1 (December 18, 2019) ##
19
29
 
20
30
  * Fix possible information leak / session hijacking vulnerability.
21
31
 
22
32
  The `ActionDispatch::Session::MemcacheStore` is still vulnerable given it requires the
23
33
  gem dalli to be updated as well.
34
+
35
+ _Breaking changes:_
36
+ * `session.id` now returns an instance of `Rack::Session::SessionId` and not a String (use `session.id.public_id` to restore the old behaviour, see #38063)
37
+ * Accessing the session id using `session[:session_id]`/`session['session_id']` no longer works with
38
+ ruby 2.2 (see https://github.com/rails/rails/commit/2a52a38cb51b65d71cf91fc960777213cf96f962#commitcomment-37929811)
24
39
 
25
40
  CVE-2019-16782.
26
41
 
@@ -321,11 +321,6 @@ module ActionController #:nodoc:
321
321
  global_csrf_token(session)
322
322
  end
323
323
 
324
- one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
325
- encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
326
- masked_token = one_time_pad + encrypted_csrf_token
327
- Base64.urlsafe_encode64(masked_token, padding: false)
328
-
329
324
  mask_token(raw_token)
330
325
  end
331
326
 
@@ -338,7 +333,7 @@ module ActionController #:nodoc:
338
333
  end
339
334
 
340
335
  begin
341
- masked_token = Base64.strict_decode64(encoded_masked_token)
336
+ masked_token = Base64.urlsafe_decode64(encoded_masked_token)
342
337
  rescue ArgumentError # encoded_masked_token is invalid Base64
343
338
  return false
344
339
  end
@@ -376,7 +371,7 @@ module ActionController #:nodoc:
376
371
  one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
377
372
  encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
378
373
  masked_token = one_time_pad + encrypted_csrf_token
379
- Base64.strict_encode64(masked_token)
374
+ Base64.urlsafe_encode64(masked_token).delete("=")
380
375
  end
381
376
 
382
377
  def compare_with_real_token(token, session) # :doc:
@@ -402,8 +397,8 @@ module ActionController #:nodoc:
402
397
  end
403
398
 
404
399
  def real_csrf_token(session) # :doc:
405
- session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
406
- Base64.strict_decode64(session[:_csrf_token])
400
+ session[:_csrf_token] ||= SecureRandom.urlsafe_base64(AUTHENTICITY_TOKEN_LENGTH)
401
+ Base64.urlsafe_decode64(session[:_csrf_token])
407
402
  end
408
403
 
409
404
  def per_form_csrf_token(session, action_path, method) # :doc:
@@ -177,12 +177,12 @@ module ActionController
177
177
 
178
178
  # Methods #destroy and #load! are overridden to avoid calling methods on the
179
179
  # @store object, which does not exist for the TestSession class.
180
- class TestSession < Rack::Session::Abstract::SessionHash #:nodoc:
180
+ class TestSession < Rack::Session::Abstract::PersistedSecure::SecureSessionHash #:nodoc:
181
181
  DEFAULT_OPTIONS = Rack::Session::Abstract::Persisted::DEFAULT_OPTIONS
182
182
 
183
183
  def initialize(session = {})
184
184
  super(nil, nil)
185
- @id = SecureRandom.hex(16)
185
+ @id = Rack::Session::SessionId.new(SecureRandom.hex(16))
186
186
  @data = stringify_keys(session)
187
187
  @loaded = true
188
188
  end
@@ -93,7 +93,7 @@ module ActionDispatch
93
93
  key = key.to_s
94
94
 
95
95
  if key == "session_id"
96
- id&.public_id
96
+ id && id.public_id
97
97
  else
98
98
  @delegate[key]
99
99
  end
@@ -401,6 +401,7 @@ module ActionDispatch
401
401
  super
402
402
  end
403
403
  end
404
+ ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true)
404
405
  end
405
406
  end
406
407
 
@@ -9,8 +9,8 @@ module ActionPack
9
9
  module VERSION
10
10
  MAJOR = 5
11
11
  MINOR = 2
12
- TINY = 4
13
- PRE = "5"
12
+ TINY = 5
13
+ PRE = nil
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
16
16
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionpack
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.2.4.5
4
+ version: 5.2.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-02-10 00:00:00.000000000 Z
11
+ date: 2021-03-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 5.2.4.5
19
+ version: 5.2.5
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 5.2.4.5
26
+ version: 5.2.5
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: rack
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
98
98
  requirements:
99
99
  - - '='
100
100
  - !ruby/object:Gem::Version
101
- version: 5.2.4.5
101
+ version: 5.2.5
102
102
  type: :runtime
103
103
  prerelease: false
104
104
  version_requirements: !ruby/object:Gem::Requirement
105
105
  requirements:
106
106
  - - '='
107
107
  - !ruby/object:Gem::Version
108
- version: 5.2.4.5
108
+ version: 5.2.5
109
109
  - !ruby/object:Gem::Dependency
110
110
  name: activemodel
111
111
  requirement: !ruby/object:Gem::Requirement
112
112
  requirements:
113
113
  - - '='
114
114
  - !ruby/object:Gem::Version
115
- version: 5.2.4.5
115
+ version: 5.2.5
116
116
  type: :development
117
117
  prerelease: false
118
118
  version_requirements: !ruby/object:Gem::Requirement
119
119
  requirements:
120
120
  - - '='
121
121
  - !ruby/object:Gem::Version
122
- version: 5.2.4.5
122
+ version: 5.2.5
123
123
  description: Web apps on Rails. Simple, battle-tested conventions for building and
124
124
  testing MVC web applications. Works with any Rack-compatible server.
125
125
  email: david@loudthinking.com
@@ -299,8 +299,8 @@ homepage: http://rubyonrails.org
299
299
  licenses:
300
300
  - MIT
301
301
  metadata:
302
- source_code_uri: https://github.com/rails/rails/tree/v5.2.4.5/actionpack
303
- changelog_uri: https://github.com/rails/rails/blob/v5.2.4.5/actionpack/CHANGELOG.md
302
+ source_code_uri: https://github.com/rails/rails/tree/v5.2.5/actionpack
303
+ changelog_uri: https://github.com/rails/rails/blob/v5.2.5/actionpack/CHANGELOG.md
304
304
  post_install_message:
305
305
  rdoc_options: []
306
306
  require_paths:
@@ -317,7 +317,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
317
317
  version: '0'
318
318
  requirements:
319
319
  - none
320
- rubygems_version: 3.0.3
320
+ rubygems_version: 3.1.2
321
321
  signing_key:
322
322
  specification_version: 4
323
323
  summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).