actionpack 7.0.0.rc1 → 7.0.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a040a28754f07052c56e9ef1c1c940413642486fc047c3c844ed8beb37493f5d
-  data.tar.gz: 559e290b6f39a7bc50d3b1791dbb7fc48500ff38642e6ae28d4804dcb8429a33
+  metadata.gz: 372781a07c265daab499383ce1e623018448f5bec28cc20962e1a17f77fb07e8
+  data.tar.gz: a3354d53f62901144799dfae0f3bb4e641801205a1a9b5221614699fb77f6bc8
 SHA512:
-  metadata.gz: 0ab82978fa296a09c177352859e3f8b39938250339ff4d67473ae174799f5a4fd102e545c83615f3ca83eaf00c01f3ab34c654a63e2872161a0758ab9fd8bd2a
-  data.tar.gz: e8b8ae155bd7c6ea6516bc3d980a40eec92b710057b8a461ca91541e4ce488105d09d47f72fb20a328845874420c7f576a0125c3ad92fe0ec444f78e79417927
+  metadata.gz: 51f7f747ecbf598093154bea8274b8b5df37274d2d125b5c32f1e7a4d656e246477dbe6322d8b16c14af55c858482ae928c0c5c811f36ea3ed76067cc4802c99
+  data.tar.gz: 4ab94ed159cc5d6742fde69bdeda56f922f93a168cc83a09100fc11bbf073f7ad98f2f3e5814c9d465cb72fd75aa7e71a69a3055e0ab58ce15c6ab185f68111b

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Rails 7.0.0.rc2 (December 14, 2021) ##
+
+*   Fix X_FORWARDED_HOST protection.  [CVE-2021-44528]
+
 *   `Rails.application.executor` hooks can now be called around every request in a `ActionController::TestCase`
 
     This helps to better simulate request or job local state being reset between requests and prevent state

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -52,7 +52,7 @@ module ActionDispatch
 
         def sanitize_string(host)
           if host.start_with?(".")
-            /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
+            /\A([a-z0-9-]+\.)?#{Regexp.escape(host[1..-1])}\z/i
           else
             /\A#{Regexp.escape host}\z/i
           end
@@ -120,13 +120,9 @@ module ActionDispatch
     end
 
     private
-      HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
-      VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
-      VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
-
       def authorized?(request)
-        origin_host = request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
-        forwarded_host = request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
+        origin_host = request.get_header("HTTP_HOST")
+        forwarded_host = request.x_forwarded_host&.split(/,\s?/)&.last
 
         @permissions.allows?(origin_host) && (forwarded_host.blank? || @permissions.allows?(forwarded_host))
       end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 0
     TINY  = 0
-    PRE   = "rc1"
+    PRE   = "rc2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.0.0.rc1
+  version: 7.0.0.rc2
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-12-06 00:00:00.000000000 Z
+date: 2021-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0.rc1
+        version: 7.0.0.rc2
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,12 +310,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.0.rc1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.0.rc1/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.0.rc2/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.0.rc2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.0.rc1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.0.rc2/actionpack
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -331,8 +331,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.1
 requirements:
 - none
-rubygems_version: 3.2.22
-signing_key: 
+rubygems_version: 3.2.15
+signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []