RubyGems - actionpack - Versions diffs - 6.1.7 → 6.1.7.6 - Mend

actionpack 6.1.7 → 6.1.7.6

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (7) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +42 -0
data/lib/action_controller/metal/redirecting.rb +20 -1
data/lib/action_dispatch/http/cache.rb +1 -1
data/lib/action_dispatch/middleware/cookies.rb +28 -20
data/lib/action_pack/gem_version.rb +1 -1
metadata +11 -11

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c58bf0e36f4adb5462b17ce1aec73f8921fd7b1e410d603b27dd9d26e78f7b1
-  data.tar.gz: dd9e4d6c95a08d6312fd57da77e406dab8ebd20da21c16488f4c11f46e1852e0
+  metadata.gz: cf3c37c7c59ec5fc92e7e4df974735908f6d1af7c899884651d4241354721ec1
+  data.tar.gz: 5a9433cb7a24a1a13c4014a0fbde11348d980a0741ca6a1825d0dcbc1a7c8fc0
 SHA512:
-  metadata.gz: 807c1609517c6ddff69380004b9e04f8224e8dabe6d8aa718ee33a0fbcb4f6d0b6a99a0f35ea41781909506f89ed0d60b5e69bf977c8ba26a1973e9cc6bcad2c
-  data.tar.gz: e09617371f401129d860f990573e4ab6515d414361629ebc85e01375151cdec0446fb93af323d6d1fe0ae427cb32b4bf12a14c5fae0c58fed91e0cbe23efa6f5
+  metadata.gz: 00405c0603e1224c6067f5c857814790afa1628916de3c4ea2a80bb0f7e40c4065cd15fb20da3036f73081f3fc03120c6a7fe063600dbd37ac2302bdef0297e7
+  data.tar.gz: cc52b9ad0ba74c16bdbe0b3a3d04f28be88b5f786d2d33fc468d9f58ced0918498fcbe28ce3418c8b786363ecd8d5141a1a6d1d6e163e5e5929d90da9e687d1f

data/CHANGELOG.md CHANGED Viewed

@@ -1,3 +1,45 @@
+## Rails 6.1.7.6 (August 22, 2023) ##
+*   No changes.
+## Rails 6.1.7.5 (August 22, 2023) ##
+*   No changes.
+## Rails 6.1.7.4 (June 26, 2023) ##
+*   Raise an exception if illegal characters are provide to redirect_to
+    [CVE-2023-28362]
+    *Zack Deveau*
+## Rails 6.1.7.3 (March 13, 2023) ##
+*   No changes.
+## Rails 6.1.7.2 (January 24, 2023) ##
+*   Fix `domain: :all` for two letter TLD
+    This fixes a compatibility issue introduced in our previous security
+    release when using `domain: :all` with a two letter but single level top
+    level domain domain (like `.ca`, rather than `.co.uk`).
+## Rails 6.1.7.1 (January 17, 2023) ##
+*   Avoid regex backtracking on If-None-Match header
+    [CVE-2023-22795]
+*   Use string#split instead of regex for domain parts
+    [CVE-2023-22792]
 ## Rails 6.1.7 (September 09, 2022) ##
 *   No changes.

data/lib/action_controller/metal/redirecting.rb CHANGED Viewed

@@ -7,6 +7,10 @@ module ActionController
     include AbstractController::Logger
     include ActionController::UrlFor
+    ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/.freeze
+    class UnsafeRedirectError < StandardError; end
     # Redirects the browser to the target specified in +options+. This parameter can be any one of:
     #
     # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
@@ -60,7 +64,11 @@ module ActionController
       raise AbstractController::DoubleRenderError if response_body
       self.status        = _extract_redirect_to_status(options, response_options)
-      self.location      = _compute_redirect_to_location(request, options)
+      redirect_to_location = _compute_redirect_to_location(request, options)
+      _ensure_url_is_http_header_safe(redirect_to_location)
+      self.location      = redirect_to_location
       self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
     end
@@ -129,5 +137,16 @@ module ActionController
       rescue ArgumentError, URI::Error
         false
       end
+      def _ensure_url_is_http_header_safe(url)
+        # Attempt to comply with the set of valid token characters
+        # defined for an HTTP header value in
+        # https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
+        if url.match(ILLEGAL_HEADER_VALUE_REGEX)
+          msg = "The redirect URL #{url} contains one or more illegal HTTP header field character. " \
+            "Set of legal characters defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6"
+          raise UnsafeRedirectError, msg
+        end
+      end
   end
 end

data/lib/action_dispatch/http/cache.rb CHANGED Viewed

@@ -18,7 +18,7 @@ module ActionDispatch
         end
         def if_none_match_etags
-          if_none_match ? if_none_match.split(/\s*,\s*/) : []
+          if_none_match ? if_none_match.split(",").each(&:strip!) : []
         end
         def not_modified?(modified_at)

data/lib/action_dispatch/middleware/cookies.rb CHANGED Viewed

@@ -283,20 +283,6 @@ module ActionDispatch
     class CookieJar #:nodoc:
       include Enumerable, ChainedCookieJars
-      # This regular expression is used to split the levels of a domain.
-      # The top level domain can be any string without a period or
-      # **.**, ***.** style TLDs like co.uk or com.au
-      #
-      # www.example.co.uk gives:
-      # $& => example.co.uk
-      #
-      # example.com gives:
-      # $& => example.com
-      #
-      # lots.of.subdomains.example.local gives:
-      # $& => example.local
-      DOMAIN_REGEXP = /[^.]*\.([^.]*|..\...|...\...)$/
       def self.build(req, cookies)
         jar = new(req)
         jar.update(cookies)
@@ -449,13 +435,35 @@ module ActionDispatch
           options[:same_site] ||= cookies_same_site_protection.call(request)
           if options[:domain] == :all || options[:domain] == "all"
-            # If there is a provided tld length then we use it otherwise default domain regexp.
-            domain_regexp = options[:tld_length] ? /([^.]+\.?){#{options[:tld_length]}}$/ : DOMAIN_REGEXP
+            cookie_domain = ""
+            dot_splitted_host = request.host.split('.', -1)
+            # Case where request.host is not an IP address or it's an invalid domain
+            # (ip confirms to the domain structure we expect so we explicitly check for ip)
+            if request.host.match?(/^[\d.]+$/) || dot_splitted_host.include?("") || dot_splitted_host.length == 1
+              options[:domain] = nil
+              return
+            end
+            # If there is a provided tld length then we use it otherwise default domain.
+            if options[:tld_length].present?
+              # Case where the tld_length provided is valid
+              if dot_splitted_host.length >= options[:tld_length]
+                cookie_domain = dot_splitted_host.last(options[:tld_length]).join('.')
+              end
+            # Case where tld_length is not provided
+            else
+              # Regular TLDs
+              if !(/\.[^.]{2,3}\.[^.]{2}\z/.match?(request.host))
+                cookie_domain = dot_splitted_host.last(2).join(".")
+              # **.**, ***.** style TLDs like co.uk and com.au
+              else
+                cookie_domain = dot_splitted_host.last(3).join('.')
+              end
+            end
-            # If host is not ip and matches domain regexp.
-            # (ip confirms to domain regexp so we explicitly check for ip)
-            options[:domain] = if !request.host.match?(/^[\d.]+$/) && (request.host =~ domain_regexp)
-              ".#{$&}"
+            options[:domain] = if cookie_domain.present?
+              ".#{cookie_domain}"
             end
           elsif options[:domain].is_a? Array
             # If host matches one of the supplied domains.

data/lib/action_pack/gem_version.rb CHANGED Viewed

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 1
     TINY  = 7
-    PRE   = nil
+    PRE   = "6"
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata CHANGED Viewed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.1.7
+  version: 6.1.7.6
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-09 00:00:00.000000000 Z
+date: 2023-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.6
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -309,10 +309,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.7/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.7/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.6/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.6/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.7/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.6/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []