actionpack 6.1.7 → 6.1.7.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 2c58bf0e36f4adb5462b17ce1aec73f8921fd7b1e410d603b27dd9d26e78f7b1
4
- data.tar.gz: dd9e4d6c95a08d6312fd57da77e406dab8ebd20da21c16488f4c11f46e1852e0
3
+ metadata.gz: c3760cc7eae59512ccfc87427b71376bccfa5f984b3926e0a0cb9754be86508e
4
+ data.tar.gz: 997c9fde966714d858387bb1eb9fba0e7abeb8f606c35e2fd0a0ee3847c24421
5
5
  SHA512:
6
- metadata.gz: 807c1609517c6ddff69380004b9e04f8224e8dabe6d8aa718ee33a0fbcb4f6d0b6a99a0f35ea41781909506f89ed0d60b5e69bf977c8ba26a1973e9cc6bcad2c
7
- data.tar.gz: e09617371f401129d860f990573e4ab6515d414361629ebc85e01375151cdec0446fb93af323d6d1fe0ae427cb32b4bf12a14c5fae0c58fed91e0cbe23efa6f5
6
+ metadata.gz: 24c8f7f9a94888b00b07a7f0b7383981d82f2710eb6002cfbf41d83dc7efd5458cccd4be3b1ad23655b73fcb8a88c78f3f24ff67264b7c647f0fcd51aae41f7f
7
+ data.tar.gz: 045b672d31c7176c686d8141ff64fc4eab66b1123e0294712e5fb67392dd32b63b1863a4e5442248536f69043b72c41036a13c104999be20841458bb0a14b3f9
data/CHANGELOG.md CHANGED
@@ -1,3 +1,14 @@
1
+ ## Rails 6.1.7.1 (January 17, 2023) ##
2
+
3
+ * Avoid regex backtracking on If-None-Match header
4
+
5
+ [CVE-2023-22795]
6
+
7
+ * Use string#split instead of regex for domain parts
8
+
9
+ [CVE-2023-22792]
10
+
11
+
1
12
  ## Rails 6.1.7 (September 09, 2022) ##
2
13
 
3
14
  * No changes.
@@ -18,7 +18,7 @@ module ActionDispatch
18
18
  end
19
19
 
20
20
  def if_none_match_etags
21
- if_none_match ? if_none_match.split(/\s*,\s*/) : []
21
+ if_none_match ? if_none_match.split(",").each(&:strip!) : []
22
22
  end
23
23
 
24
24
  def not_modified?(modified_at)
@@ -283,20 +283,6 @@ module ActionDispatch
283
283
  class CookieJar #:nodoc:
284
284
  include Enumerable, ChainedCookieJars
285
285
 
286
- # This regular expression is used to split the levels of a domain.
287
- # The top level domain can be any string without a period or
288
- # **.**, ***.** style TLDs like co.uk or com.au
289
- #
290
- # www.example.co.uk gives:
291
- # $& => example.co.uk
292
- #
293
- # example.com gives:
294
- # $& => example.com
295
- #
296
- # lots.of.subdomains.example.local gives:
297
- # $& => example.local
298
- DOMAIN_REGEXP = /[^.]*\.([^.]*|..\...|...\...)$/
299
-
300
286
  def self.build(req, cookies)
301
287
  jar = new(req)
302
288
  jar.update(cookies)
@@ -449,13 +435,35 @@ module ActionDispatch
449
435
  options[:same_site] ||= cookies_same_site_protection.call(request)
450
436
 
451
437
  if options[:domain] == :all || options[:domain] == "all"
452
- # If there is a provided tld length then we use it otherwise default domain regexp.
453
- domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
438
+ cookie_domain = ""
439
+ dot_splitted_host = request.host.split('.', -1)
440
+
441
+ # Case where request.host is not an IP address or it's an invalid domain
442
+ # (ip confirms to the domain structure we expect so we explicitly check for ip)
443
+ if request.host.match?(/^[\d.]+$/) || dot_splitted_host.include?("") || dot_splitted_host.length == 1
444
+ options[:domain] = nil
445
+ return
446
+ end
447
+
448
+ # If there is a provided tld length then we use it otherwise default domain.
449
+ if options[:tld_length].present?
450
+ # Case where the tld_length provided is valid
451
+ if dot_splitted_host.length >= options[:tld_length]
452
+ cookie_domain = dot_splitted_host.last(options[:tld_length]).join('.')
453
+ end
454
+ # Case where tld_length is not provided
455
+ else
456
+ # Regular TLDs
457
+ if !(/([^.]{2,3}\.[^.]{2})$/.match?(request.host))
458
+ cookie_domain = dot_splitted_host.last(2).join('.')
459
+ # **.**, ***.** style TLDs like co.uk and com.au
460
+ else
461
+ cookie_domain = dot_splitted_host.last(3).join('.')
462
+ end
463
+ end
454
464
 
455
- # If host is not ip and matches domain regexp.
456
- # (ip confirms to domain regexp so we explicitly check for ip)
457
- options[:domain] = if !request.host.match?(/^[\d.]+$/) && (request.host =~ domain_regexp)
458
- ".#{$&}"
465
+ options[:domain] = if cookie_domain.present?
466
+ ".#{cookie_domain}"
459
467
  end
460
468
  elsif options[:domain].is_a? Array
461
469
  # If host matches one of the supplied domains.
@@ -10,7 +10,7 @@ module ActionPack
10
10
  MAJOR = 6
11
11
  MINOR = 1
12
12
  TINY = 7
13
- PRE = nil
13
+ PRE = "1"
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
16
16
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionpack
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.1.7
4
+ version: 6.1.7.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-09-09 00:00:00.000000000 Z
11
+ date: 2023-01-17 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 6.1.7
19
+ version: 6.1.7.1
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 6.1.7
26
+ version: 6.1.7.1
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: rack
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
98
98
  requirements:
99
99
  - - '='
100
100
  - !ruby/object:Gem::Version
101
- version: 6.1.7
101
+ version: 6.1.7.1
102
102
  type: :runtime
103
103
  prerelease: false
104
104
  version_requirements: !ruby/object:Gem::Requirement
105
105
  requirements:
106
106
  - - '='
107
107
  - !ruby/object:Gem::Version
108
- version: 6.1.7
108
+ version: 6.1.7.1
109
109
  - !ruby/object:Gem::Dependency
110
110
  name: activemodel
111
111
  requirement: !ruby/object:Gem::Requirement
112
112
  requirements:
113
113
  - - '='
114
114
  - !ruby/object:Gem::Version
115
- version: 6.1.7
115
+ version: 6.1.7.1
116
116
  type: :development
117
117
  prerelease: false
118
118
  version_requirements: !ruby/object:Gem::Requirement
119
119
  requirements:
120
120
  - - '='
121
121
  - !ruby/object:Gem::Version
122
- version: 6.1.7
122
+ version: 6.1.7.1
123
123
  description: Web apps on Rails. Simple, battle-tested conventions for building and
124
124
  testing MVC web applications. Works with any Rack-compatible server.
125
125
  email: david@loudthinking.com
@@ -309,10 +309,10 @@ licenses:
309
309
  - MIT
310
310
  metadata:
311
311
  bug_tracker_uri: https://github.com/rails/rails/issues
312
- changelog_uri: https://github.com/rails/rails/blob/v6.1.7/actionpack/CHANGELOG.md
313
- documentation_uri: https://api.rubyonrails.org/v6.1.7/
312
+ changelog_uri: https://github.com/rails/rails/blob/v6.1.7.1/actionpack/CHANGELOG.md
313
+ documentation_uri: https://api.rubyonrails.org/v6.1.7.1/
314
314
  mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
315
- source_code_uri: https://github.com/rails/rails/tree/v6.1.7/actionpack
315
+ source_code_uri: https://github.com/rails/rails/tree/v6.1.7.1/actionpack
316
316
  rubygems_mfa_required: 'true'
317
317
  post_install_message:
318
318
  rdoc_options: []
@@ -330,7 +330,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
330
330
  version: '0'
331
331
  requirements:
332
332
  - none
333
- rubygems_version: 3.3.3
333
+ rubygems_version: 3.4.3
334
334
  signing_key:
335
335
  specification_version: 4
336
336
  summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).