actionpack 7.0.5 → 7.0.5.1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +7 -0
- data/lib/action_controller/metal/redirecting.rb +18 -1
- data/lib/action_pack/gem_version.rb +1 -1
- metadata +15 -15
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ffffa8c7f4e6595a5c24bc31fa18fcedb9159148d8fe7e4b0124d9e55f0fdce9
|
4
|
+
data.tar.gz: 3cc3953111b5ff5f631ab16bccd16cfb1679e7aba9c6bdd67b4eb5f4f1555cc6
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: '08f187c696c70d8ae6d2178877a4069d89b3e47a75ad01b87417236b04eb75a44168163785174bbcc3e1b301e24967dece59d747543578df27560289c8f4bcc9'
|
7
|
+
data.tar.gz: 2638644d64c596bac33fc32885bd03f338d2e241f5e74fe04946a92452768d2dec19845c3cea1c3e95a22b69fef2666ac8d7261bb2aa8650649cb1aca398027a
|
data/CHANGELOG.md
CHANGED
@@ -4,6 +4,8 @@ module ActionController
|
|
4
4
|
module Redirecting
|
5
5
|
extend ActiveSupport::Concern
|
6
6
|
|
7
|
+
ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/.freeze
|
8
|
+
|
7
9
|
include AbstractController::Logger
|
8
10
|
include ActionController::UrlFor
|
9
11
|
|
@@ -86,7 +88,11 @@ module ActionController
|
|
86
88
|
allow_other_host = response_options.delete(:allow_other_host) { _allow_other_host }
|
87
89
|
|
88
90
|
self.status = _extract_redirect_to_status(options, response_options)
|
89
|
-
|
91
|
+
|
92
|
+
redirect_to_location = _compute_redirect_to_location(request, options)
|
93
|
+
_ensure_url_is_http_header_safe(redirect_to_location)
|
94
|
+
|
95
|
+
self.location = _enforce_open_redirect_protection(redirect_to_location, allow_other_host: allow_other_host)
|
90
96
|
self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
|
91
97
|
end
|
92
98
|
|
@@ -204,5 +210,16 @@ module ActionController
|
|
204
210
|
rescue ArgumentError, URI::Error
|
205
211
|
false
|
206
212
|
end
|
213
|
+
|
214
|
+
def _ensure_url_is_http_header_safe(url)
|
215
|
+
# Attempt to comply with the set of valid token characters
|
216
|
+
# defined for an HTTP header value in
|
217
|
+
# https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
|
218
|
+
if url.match(ILLEGAL_HEADER_VALUE_REGEX)
|
219
|
+
msg = "The redirect URL #{url} contains one or more illegal HTTP header field character. " \
|
220
|
+
"Set of legal characters defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6"
|
221
|
+
raise UnsafeRedirectError, msg
|
222
|
+
end
|
223
|
+
end
|
207
224
|
end
|
208
225
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: actionpack
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 7.0.5
|
4
|
+
version: 7.0.5.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- David Heinemeier Hansson
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-
|
11
|
+
date: 2023-06-26 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: activesupport
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 7.0.5
|
19
|
+
version: 7.0.5.1
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 7.0.5
|
26
|
+
version: 7.0.5.1
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: rack
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -98,28 +98,28 @@ dependencies:
|
|
98
98
|
requirements:
|
99
99
|
- - '='
|
100
100
|
- !ruby/object:Gem::Version
|
101
|
-
version: 7.0.5
|
101
|
+
version: 7.0.5.1
|
102
102
|
type: :runtime
|
103
103
|
prerelease: false
|
104
104
|
version_requirements: !ruby/object:Gem::Requirement
|
105
105
|
requirements:
|
106
106
|
- - '='
|
107
107
|
- !ruby/object:Gem::Version
|
108
|
-
version: 7.0.5
|
108
|
+
version: 7.0.5.1
|
109
109
|
- !ruby/object:Gem::Dependency
|
110
110
|
name: activemodel
|
111
111
|
requirement: !ruby/object:Gem::Requirement
|
112
112
|
requirements:
|
113
113
|
- - '='
|
114
114
|
- !ruby/object:Gem::Version
|
115
|
-
version: 7.0.5
|
115
|
+
version: 7.0.5.1
|
116
116
|
type: :development
|
117
117
|
prerelease: false
|
118
118
|
version_requirements: !ruby/object:Gem::Requirement
|
119
119
|
requirements:
|
120
120
|
- - '='
|
121
121
|
- !ruby/object:Gem::Version
|
122
|
-
version: 7.0.5
|
122
|
+
version: 7.0.5.1
|
123
123
|
description: Web apps on Rails. Simple, battle-tested conventions for building and
|
124
124
|
testing MVC web applications. Works with any Rack-compatible server.
|
125
125
|
email: david@loudthinking.com
|
@@ -310,12 +310,12 @@ licenses:
|
|
310
310
|
- MIT
|
311
311
|
metadata:
|
312
312
|
bug_tracker_uri: https://github.com/rails/rails/issues
|
313
|
-
changelog_uri: https://github.com/rails/rails/blob/v7.0.5/actionpack/CHANGELOG.md
|
314
|
-
documentation_uri: https://api.rubyonrails.org/v7.0.5/
|
313
|
+
changelog_uri: https://github.com/rails/rails/blob/v7.0.5.1/actionpack/CHANGELOG.md
|
314
|
+
documentation_uri: https://api.rubyonrails.org/v7.0.5.1/
|
315
315
|
mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
|
316
|
-
source_code_uri: https://github.com/rails/rails/tree/v7.0.5/actionpack
|
316
|
+
source_code_uri: https://github.com/rails/rails/tree/v7.0.5.1/actionpack
|
317
317
|
rubygems_mfa_required: 'true'
|
318
|
-
post_install_message:
|
318
|
+
post_install_message:
|
319
319
|
rdoc_options: []
|
320
320
|
require_paths:
|
321
321
|
- lib
|
@@ -331,8 +331,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
331
331
|
version: '0'
|
332
332
|
requirements:
|
333
333
|
- none
|
334
|
-
rubygems_version: 3.
|
335
|
-
signing_key:
|
334
|
+
rubygems_version: 3.3.3
|
335
|
+
signing_key:
|
336
336
|
specification_version: 4
|
337
337
|
summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
|
338
338
|
test_files: []
|