actionpack 6.1.1 → 6.1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3813bd7e46eeb386962cafd48601aace5759055c9311cc47e79706458e4d8723
-  data.tar.gz: 9b1c73e829be328eff697fb0472c2917516a7956db547e6f364c1fa194a49cd1
+  metadata.gz: 9cfba18fd1e2c6507de318e22c9cab8f878c22b9cbce70065f9c2ff9053f1d96
+  data.tar.gz: 178c4347f79392aaa6d452c3eeb406cbecf66a9b3ece0d244f98d7a4fa15b6ab
 SHA512:
-  metadata.gz: 271e0b7f7ce9cb659ffe7684f03677ea6699f065e1b2c1e8ce20cf992f3525c6ea2947702308b764fd21407498ac0e916dbd3390934615bf0c5d73450a938927
-  data.tar.gz: 9344404abd36b7fcc6bdf73a5186bc6bfc6665565b0fce4bf143aea6d149b61eefed5ec56787bebcbf0a9307bf464bbe4d822f726965f834fc3afaa13dde786d
+  metadata.gz: 6479340989a0677d3e64e0723a67c0cc64ea4dc9d5fcfe6bfad6538703582f3b95bc2426b68c56c2dda3a1b66842e7ed890b70fefbf136c8a198d23336525447
+  data.tar.gz: 9021e02a953bf859d984e3722561745d0b562292b3fe3566ee1d362a9eb8c06af868f2d17db7dd5558e31871f626a39d8d9a7bb9b34697c5d26b8b58a533db4f

data/CHANGELOG.md

@@ -1,3 +1,59 @@
+## Rails 6.1.3.2 (May 05, 2021) ##
+
+*   Prevent open redirects by correctly escaping the host allow list
+    CVE-2021-22903
+
+*   Prevent catastrophic backtracking during mime parsing
+    CVE-2021-22902
+
+*   Prevent regex DoS in HTTP token authentication
+    CVE-2021-22904
+
+*   Prevent string polymorphic route arguments.
+
+    `url_for` supports building polymorphic URLs via an array
+    of arguments (usually symbols and records). If a developer passes a
+    user input array, strings can result in unwanted route helper calls.
+
+    CVE-2021-22885
+
+    *Gannon McGibbon*
+
+## Rails 6.1.3.1 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 6.1.3 (February 17, 2021) ##
+
+*   Re-define routes when not set correctly via inheritance.
+
+    *John Hawthorn*
+
+
+## Rails 6.1.2.1 (February 10, 2021) ##
+
+*   Prevent open redirect when allowed host starts with a dot
+
+    [CVE-2021-22881]
+
+    Thanks to @tktech (https://hackerone.com/tktech) for reporting this
+    issue and the patch!
+
+    *Aaron Patterson*
+
+
+## Rails 6.1.2 (February 09, 2021) ##
+
+*   Fix error in `ActionController::LogSubscriber` that would happen when throwing inside a controller action.
+
+    *Janko Marohnić*
+
+*   Fix `fixture_file_upload` deprecation when `file_fixture_path` is a relative path.
+
+    *Eugene Kenny*
+
+
 ## Rails 6.1.1 (January 07, 2021) ##
 
 *   Fix nil translation key lookup in controllers/

data/README.rdoc

@@ -33,7 +33,7 @@ The latest version of Action Pack can be installed with RubyGems:
 
 Source code can be downloaded as part of the Rails project on GitHub:
 
-* https://github.com/rails/rails/tree/master/actionpack
+* https://github.com/rails/rails/tree/main/actionpack
 
 
 == License

data/lib/abstract_controller/railties/routes_helpers.rb

@@ -7,11 +7,27 @@ module AbstractController
         Module.new do
           define_method(:inherited) do |klass|
             super(klass)
-            if namespace = klass.module_parents.detect { |m| m.respond_to?(:railtie_routes_url_helpers) }
+
+            namespace = klass.module_parents.detect { |m| m.respond_to?(:railtie_routes_url_helpers) }
+            actual_routes = namespace ? namespace.railtie_routes_url_helpers._routes : routes
+
+            if namespace
               klass.include(namespace.railtie_routes_url_helpers(include_path_helpers))
             else
               klass.include(routes.url_helpers(include_path_helpers))
             end
+
+            # In the case that we have ex.
+            #   class A::Foo < ApplicationController
+            #   class Bar < A::Foo
+            # We will need to redefine _routes because it will not be correct
+            # via inheritance.
+            unless klass._routes.equal?(actual_routes)
+              klass.redefine_singleton_method(:_routes) { actual_routes }
+              klass.include(Module.new do
+                define_method(:_routes) { @_routes || actual_routes }
+              end)
+            end
           end
         end
       end

data/lib/action_controller/log_subscriber.rb

@@ -23,7 +23,7 @@ module ActionController
         additions = ActionController::Base.log_process_action(payload)
         status = payload[:status]
 
-        if status.nil? && (exception_class_name = payload[:exception].first)
+        if status.nil? && (exception_class_name = payload[:exception]&.first)
           status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception_class_name)
         end
 

data/lib/action_controller/metal/http_authentication.rb

@@ -407,7 +407,7 @@ module ActionController
     module Token
       TOKEN_KEY = "token="
       TOKEN_REGEX = /^(Token|Bearer)\s+/
-      AUTHN_PAIR_DELIMITERS = /(?:,|;|\t+)/
+      AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
       extend self
 
       module ControllerMethods
@@ -484,7 +484,7 @@ module ActionController
       def raw_params(auth)
         _raw_params = auth.sub(TOKEN_REGEX, "").split(/\s*#{AUTHN_PAIR_DELIMITERS}\s*/)
 
-        if !_raw_params.first.start_with?(TOKEN_KEY)
+        if !_raw_params.first&.start_with?(TOKEN_KEY)
           _raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}"
         end
 

data/lib/action_controller/renderer.rb

@@ -84,7 +84,7 @@ module ActionController
     #
     # If no <tt>options</tt> hash is passed or if <tt>:update</tt> is specified, then:
     #
-    # If an object responding to `render_in` is passed, `render_in` is called on the object,
+    # If an object responding to +render_in+ is passed, +render_in+ is called on the object,
     # passing in the current view context.
     #
     # Otherwise, a partial is rendered using the second parameter as the locals hash.

data/lib/action_dispatch/http/mime_type.rb

@@ -229,7 +229,7 @@ module Mime
     MIME_PARAMETER_KEY = "[a-zA-Z0-9][a-zA-Z0-9#{Regexp.escape('!#$&-^_.+')}]{0,126}"
     MIME_PARAMETER_VALUE = "#{Regexp.escape('"')}?[a-zA-Z0-9][a-zA-Z0-9#{Regexp.escape('!#$&-^_.+')}]{0,126}#{Regexp.escape('"')}?"
     MIME_PARAMETER = "\s*\;\s*#{MIME_PARAMETER_KEY}(?:\=#{MIME_PARAMETER_VALUE})?"
-    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?:\s*#{MIME_PARAMETER}\s*)*)\z/
+    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
 
     class InvalidMimeType < StandardError; end
 
@@ -330,7 +330,7 @@ module Mime
   end
 
   # ALL isn't a real MIME type, so we don't register it for lookup with the
-  # other concrete types. It's a wildcard match that we use for `respond_to`
+  # other concrete types. It's a wildcard match that we use for +respond_to+
   # negotiation internals.
   ALL = AllType.instance
 

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -13,7 +13,7 @@ module ActionDispatch
   #
   # When a request comes to an unauthorized host, the +response_app+
   # application will be executed and rendered. If no +response_app+ is given, a
-  # default one will run, which responds with +403 Forbidden+.
+  # default one will run, which responds with <tt>403 Forbidden</tt>.
   class HostAuthorization
     class Permissions # :nodoc:
       def initialize(hosts)
@@ -53,7 +53,7 @@ module ActionDispatch
           if host.start_with?(".")
             /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
           else
-            /\A#{host}\z/i
+            /\A#{Regexp.escape host}\z/i
           end
         end
     end
@@ -103,11 +103,20 @@ module ActionDispatch
 
     private
       def authorized?(request)
-        origin_host = request.get_header("HTTP_HOST").to_s.sub(/:\d+\z/, "")
-        forwarded_host = request.x_forwarded_host.to_s.split(/,\s?/).last.to_s.sub(/:\d+\z/, "")
-
-        @permissions.allows?(origin_host) &&
-          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
+        valid_host = /
+          \A
+          (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\])
+          (:\d+)?
+          \z
+        /x
+
+        origin_host = valid_host.match(
+          request.get_header("HTTP_HOST").to_s.downcase)
+        forwarded_host = valid_host.match(
+          request.x_forwarded_host.to_s.split(/,\s?/).last)
+
+        origin_host && @permissions.allows?(origin_host[:host]) && (
+          forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
       end
 
       def excluded?(request)

data/lib/action_dispatch/middleware/stack.rb

@@ -43,7 +43,7 @@ module ActionDispatch
     end
 
     # This class is used to instrument the execution of a single middleware.
-    # It proxies the `call` method transparently and instruments the method
+    # It proxies the +call+ method transparently and instruments the method
     # call.
     class InstrumentationProxy
       EVENT_NAME = "process_middleware.action_dispatch"

data/lib/action_dispatch/middleware/static.rb

@@ -32,12 +32,12 @@ module ActionDispatch
   #
   # Precompressed versions of these files are checked first. Brotli (.br)
   # and gzip (.gz) files are supported. If +path+.br exists, this
-  # endpoint returns that file with a +Content-Encoding: br+ header.
+  # endpoint returns that file with a <tt>Content-Encoding: br</tt> header.
   #
   # If no matching file is found, this endpoint responds 404 Not Found.
   #
   # Pass the +root+ directory to search for matching files, an optional
-  # +index: "index"+ to change the default +path+/index.html, and optional
+  # <tt>index: "index"</tt> to change the default +path+/index.html, and optional
   # additional response headers.
   class FileHandler
     # Accept-Encoding value -> file extension

data/lib/action_dispatch/routing/polymorphic_routes.rb

@@ -287,10 +287,12 @@ module ActionDispatch
 
             args = []
 
-            route = record_list.map { |parent|
+            route = record_list.map do |parent|
               case parent
-              when Symbol, String
+              when Symbol
                 parent.to_s
+              when String
+                raise(ArgumentError, "Please use symbols for polymorphic route arguments.")
               when Class
                 args << parent
                 parent.model_name.singular_route_key
@@ -298,12 +300,14 @@ module ActionDispatch
                 args << parent.to_model
                 parent.to_model.model_name.singular_route_key
               end
-            }
+            end
 
             route <<
             case record
-            when Symbol, String
+            when Symbol
               record.to_s
+            when String
+              raise(ArgumentError, "Please use symbols for polymorphic route arguments.")
             when Class
               @key_strategy.call record.model_name
             else

data/lib/action_dispatch/routing/redirection.rb

@@ -164,7 +164,7 @@ module ActionDispatch
       #     "http://#{request.host_with_port}/#{path}"
       #   }
       #
-      # Note that the +do end+ syntax for the redirect block wouldn't work, as Ruby would pass
+      # Note that the <tt>do end</tt> syntax for the redirect block wouldn't work, as Ruby would pass
       # the block to +get+ instead of +redirect+. Use <tt>{ ... }</tt> instead.
       #
       # The options version of redirect allows you to supply only the parts of the URL which need

data/lib/action_dispatch/testing/integration.rb

@@ -199,11 +199,11 @@ module ActionDispatch
       #   merged into the Rack env hash.
       # - +env+: Additional env to pass, as a Hash. The headers will be
       #   merged into the Rack env hash.
-      # - +xhr+: Set to `true` if you want to make and Ajax request.
+      # - +xhr+: Set to +true+ if you want to make and Ajax request.
       #   Adds request headers characteristic of XMLHttpRequest e.g. HTTP_X_REQUESTED_WITH.
       #   The headers will be merged into the Rack env hash.
       # - +as+: Used for encoding the request with different content type.
-      #   Supports `:json` by default and will set the appropriate request headers.
+      #   Supports +:json+ by default and will set the appropriate request headers.
       #   The headers will be merged into the Rack env hash.
       #
       # This method is rarely used directly. Use +#get+, +#post+, or other standard

data/lib/action_dispatch/testing/test_process.rb

@@ -29,7 +29,7 @@ module ActionDispatch
               haven't set yet. Set `file_fixture_path` to discard this warning.
             EOM
           elsif path.exist?
-            non_deprecated_path = path.relative_path_from(Pathname(self.class.file_fixture_path))
+            non_deprecated_path = Pathname(File.absolute_path(path)).relative_path_from(Pathname(File.absolute_path(self.class.file_fixture_path)))
             ActiveSupport::Deprecation.warn(<<~EOM)
               Passing a path to `fixture_file_upload` relative to `fixture_path` is deprecated.
               In Rails 6.2, the path needs to be relative to `file_fixture_path`.

data/lib/action_pack/gem_version.rb

@@ -9,8 +9,8 @@ module ActionPack
   module VERSION
     MAJOR = 6
     MINOR = 1
-    TINY  = 1
-    PRE   = nil
+    TINY  = 3
+    PRE   = "2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.1.1
+  version: 6.1.3.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-07 00:00:00.000000000 Z
+date: 2021-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.1
+        version: 6.1.3.2
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -309,10 +309,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.1/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.3.2/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.3.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.3.2/actionpack
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -329,7 +329,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.2.3
+rubygems_version: 3.1.2
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).