actionpack 6.1.2 → 6.1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e18f4e0dba4fd1daa12ad504b7846ed7c35d319d793d8a999719c5f454a3a55
-  data.tar.gz: 34eca75e2ce98348b71a0138e46ff0bcbd3b2bd26888eff928c15cb5b20779a7
+  metadata.gz: 9ddc348fb8652218b5bd5b37bdb59d84478978eef60efa1e6e0ec970975e51fe
+  data.tar.gz: 3cb8f6771faff1498a49741146ee58df760bfaf71736ab90329b44141b600448
 SHA512:
-  metadata.gz: 73a46bd410d9b4d54b56d19c0f0ac5d47ac799566ba950af6bfeff17cdc370336cccd9c4b46ab8ab8dc9fca16d30b808193d496f05374f1dfd78fdd5b3b5753f
-  data.tar.gz: ce290325486805965e58919f0aabc7a702604a0495eb7028eb94be089b82ec9684eec54472842a72eabc9b79656f0012887cf217f82cf4ca0bf2e546634adadc
+  metadata.gz: ca1a39f35896900dad228fdb4174207fcf571407aa3e033a82718bf2411b2d45665bd03db6df7e21d25cc8df4aaa33d83190502be910a528b51fc4ce4871d2f3
+  data.tar.gz: 66aec3e70249c3661662c5357ba2cc53b3845449bca439c3b07e34068fbb99be354e9dfa536d1964d9446d66519c6c515125827e1cc7f3b01c046b3a9a0741b3

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## Rails 6.1.2.1 (February 10, 2021) ##
+
+*   Prevent open redirect when allowed host starts with a dot
+
+    [CVE-2021-22881]
+
+    Thanks to @tktech (https://hackerone.com/tktech) for reporting this
+    issue and the patch!
+
+    *Aaron Patterson*
+
+
 ## Rails 6.1.2 (February 09, 2021) ##
 
 *   Fix error in `ActionController::LogSubscriber` that would happen when throwing inside a controller action.

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -103,11 +103,20 @@ module ActionDispatch
 
     private
       def authorized?(request)
-        origin_host = request.get_header("HTTP_HOST").to_s.sub(/:\d+\z/, "")
-        forwarded_host = request.x_forwarded_host.to_s.split(/,\s?/).last.to_s.sub(/:\d+\z/, "")
-
-        @permissions.allows?(origin_host) &&
-          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
+        valid_host = /
+          \A
+          (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9\.:]+\])
+          (:\d+)?
+          \z
+        /x
+
+        origin_host = valid_host.match(
+          request.get_header("HTTP_HOST").to_s.downcase)
+        forwarded_host = valid_host.match(
+          request.x_forwarded_host.to_s.split(/,\s?/).last)
+
+        origin_host && @permissions.allows?(origin_host[:host]) && (
+          forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
       end
 
       def excluded?(request)

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 1
     TINY  = 2
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.1.2
+  version: 6.1.2.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-09 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.2
+        version: 6.1.2.1
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -309,11 +309,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.2/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.2/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.2.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.2/actionpack
-post_install_message:
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.2.1/actionpack
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -329,8 +329,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.2.3
-signing_key:
+rubygems_version: 3.0.3
+signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []