actionpack 6.1.7.3 → 6.1.7.4

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +7 -0
  3. data/lib/action_controller/metal/redirecting.rb +20 -1
  4. data/lib/action_pack/gem_version.rb +1 -1
  5. metadata +12 -12
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: c10133037107ff5aaf7409e2f7c9f9fd388e8f29c14c15fc034af5925d4b7c7a
4
- data.tar.gz: 877a00d73b375a160fe7c72a3f1826c159ad4927379cb613eb94e99f8740d25c
3
+ metadata.gz: 15196c583d3a47bf726bedeacc9a0c2cf693d8df54794fb4581ecb8903604da7
4
+ data.tar.gz: 838d1d5b66f972ddffa01b9273e422cb37fafe100a59f20ecce4440215cc9e6d
5
5
  SHA512:
6
- metadata.gz: 73ca8a456242af4376d413fce13d485683b8cc8900978004dcdebb9b9eb8a529f2cfe23efdcb80d15131c4173e0ac53ac8e0abe57fa7a4c066c147fe96e2e96b
7
- data.tar.gz: be6bff2896d9c16a0b6e59375d8f167c1d358c09e863cb98d0a3b242c5f1d57e09549059e8c2f7ee96e0b87ec423c7e4ab547deca4247d5c39f7c97c1b7e68f7
6
+ metadata.gz: 147a3a27d71c2476a0d31bb0051502ea9b5801d6d79ef5c797124952b8df638dc2f06596a3cb109c68e02b09964758fc597b0e951d6713dd5fb2cbbd77064e33
7
+ data.tar.gz: ecbcf82438cbd283d705e95488483f441882f93d4f07a97496434a08bb69bd37e813691741eb1c3a27035da0fe3dc4168312c87c53b2f30fd7c712f6954c7fd6
data/CHANGELOG.md CHANGED
@@ -1,3 +1,10 @@
1
+ ## Rails 6.1.7.4 (June 26, 2023) ##
2
+
3
+ * Raise an exception if illegal characters are provide to redirect_to
4
+ [CVE-2023-28362]
5
+
6
+ *Zack Deveau*
7
+
1
8
  ## Rails 6.1.7.3 (March 13, 2023) ##
2
9
 
3
10
  * No changes.
data/lib/action_controller/metal/redirecting.rb CHANGED
@@ -7,6 +7,10 @@ module ActionController
7
7
  include AbstractController::Logger
8
8
  include ActionController::UrlFor
9
9
 
10
+ ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/.freeze
11
+
12
+ class UnsafeRedirectError < StandardError; end
13
+
10
14
  # Redirects the browser to the target specified in +options+. This parameter can be any one of:
11
15
  #
12
16
  # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
@@ -60,7 +64,11 @@ module ActionController
60
64
  raise AbstractController::DoubleRenderError if response_body
61
65
 
62
66
  self.status = _extract_redirect_to_status(options, response_options)
63
- self.location = _compute_redirect_to_location(request, options)
67
+
68
+ redirect_to_location = _compute_redirect_to_location(request, options)
69
+ _ensure_url_is_http_header_safe(redirect_to_location)
70
+
71
+ self.location = redirect_to_location
64
72
  self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
65
73
  end
66
74
 
@@ -129,5 +137,16 @@ module ActionController
129
137
  rescue ArgumentError, URI::Error
130
138
  false
131
139
  end
140
+
141
+ def _ensure_url_is_http_header_safe(url)
142
+ # Attempt to comply with the set of valid token characters
143
+ # defined for an HTTP header value in
144
+ # https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
145
+ if url.match(ILLEGAL_HEADER_VALUE_REGEX)
146
+ msg = "The redirect URL #{url} contains one or more illegal HTTP header field character. " \
147
+ "Set of legal characters defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6"
148
+ raise UnsafeRedirectError, msg
149
+ end
150
+ end
132
151
  end
133
152
  end
data/lib/action_pack/gem_version.rb CHANGED
@@ -10,7 +10,7 @@ module ActionPack
10
10
  MAJOR = 6
11
11
  MINOR = 1
12
12
  TINY = 7
13
- PRE = "3"
13
+ PRE = "4"
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
16
16
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionpack
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.1.7.3
4
+ version: 6.1.7.4
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2023-03-13 00:00:00.000000000 Z
11
+ date: 2023-06-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 6.1.7.3
19
+ version: 6.1.7.4
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 6.1.7.3
26
+ version: 6.1.7.4
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: rack
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
98
98
  requirements:
99
99
  - - '='
100
100
  - !ruby/object:Gem::Version
101
- version: 6.1.7.3
101
+ version: 6.1.7.4
102
102
  type: :runtime
103
103
  prerelease: false
104
104
  version_requirements: !ruby/object:Gem::Requirement
105
105
  requirements:
106
106
  - - '='
107
107
  - !ruby/object:Gem::Version
108
- version: 6.1.7.3
108
+ version: 6.1.7.4
109
109
  - !ruby/object:Gem::Dependency
110
110
  name: activemodel
111
111
  requirement: !ruby/object:Gem::Requirement
112
112
  requirements:
113
113
  - - '='
114
114
  - !ruby/object:Gem::Version
115
- version: 6.1.7.3
115
+ version: 6.1.7.4
116
116
  type: :development
117
117
  prerelease: false
118
118
  version_requirements: !ruby/object:Gem::Requirement
119
119
  requirements:
120
120
  - - '='
121
121
  - !ruby/object:Gem::Version
122
- version: 6.1.7.3
122
+ version: 6.1.7.4
123
123
  description: Web apps on Rails. Simple, battle-tested conventions for building and
124
124
  testing MVC web applications. Works with any Rack-compatible server.
125
125
  email: david@loudthinking.com
@@ -309,10 +309,10 @@ licenses:
309
309
  - MIT
310
310
  metadata:
311
311
  bug_tracker_uri: https://github.com/rails/rails/issues
312
- changelog_uri: https://github.com/rails/rails/blob/v6.1.7.3/actionpack/CHANGELOG.md
313
- documentation_uri: https://api.rubyonrails.org/v6.1.7.3/
312
+ changelog_uri: https://github.com/rails/rails/blob/v6.1.7.4/actionpack/CHANGELOG.md
313
+ documentation_uri: https://api.rubyonrails.org/v6.1.7.4/
314
314
  mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
315
- source_code_uri: https://github.com/rails/rails/tree/v6.1.7.3/actionpack
315
+ source_code_uri: https://github.com/rails/rails/tree/v6.1.7.4/actionpack
316
316
  rubygems_mfa_required: 'true'
317
317
  post_install_message:
318
318
  rdoc_options: []
@@ -330,7 +330,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
330
330
  version: '0'
331
331
  requirements:
332
332
  - none
333
- rubygems_version: 3.4.3
333
+ rubygems_version: 3.3.3
334
334
  signing_key:
335
335
  specification_version: 4
336
336
  summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).