actionpack 7.0.8.3 → 7.0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d360b26cd2791d9a49dd735c08a9459e435665c0d060105ac067a3d44053f3ec
-  data.tar.gz: 51d45cfea83e59aaaef9dbd99aec1d2fa67dba33f301a9f8dbad380cf4c228c9
+  metadata.gz: 674d7ab95a19a8e20618b674de61f05a16b8525904ec04088b9e51c35ec57910
+  data.tar.gz: 4e118b499335d173215d2012baa270e03ba10fa683b663b25ab5e656e7d28608
 SHA512:
-  metadata.gz: d615b9f5f1a1ce80a1c629304119a94fcb35f22d422169c63359e05b160bac887b447d241500755adb77274fd60f1926ada3ed75e43e9736a12d743ecb1463c4
-  data.tar.gz: 8ae47c8f143a577573a7feb32e3810fc9f5b4242d70300bc1b683d7f7b227ef355ea5fd32d2f0207f4d452db55be73c0d21b4d86e96c7337e44dd2ca9ba40dfe
+  metadata.gz: 5df4f331a6622ab1286b48b3588f9475b7ed6132c7a6063e50306170634aba0affa2ab1401581dbbfab898553d7b92b34cb1e3987fc100a8956a2255a5cb91fa
+  data.tar.gz: da8be10bca3b1ec2379d39b7bcc70639621bd86c0922e4422efa76560d0de65775bd997e9b9edf00f9eb2acd9889044aaa451fa11d33f8da02982affe9c64adb

data/CHANGELOG.md

@@ -1,3 +1,20 @@
+## Rails 7.0.8.5 (October 15, 2024) ##
+
+*   Avoid regex backtracking in HTTP Token authentication
+
+    [CVE-2024-47887]
+
+*   Avoid regex backtracking in query parameter filtering
+
+    [CVE-2024-41128]
+
+
+## Rails 7.0.8.4 (June 04, 2024) ##
+
+*   Include the HTTP Permissions-Policy on non-HTML Content-Types
+    [CVE-2024-28103]
+
+
 ## Rails 7.0.8.3 (May 17, 2024) ##
 
 *   No changes.

data/lib/action_controller/metal/http_authentication.rb

@@ -506,7 +506,8 @@ module ActionController
       # pairs by the standardized <tt>:</tt>, <tt>;</tt>, or <tt>\t</tt>
       # delimiters defined in +AUTHN_PAIR_DELIMITERS+.
       def raw_params(auth)
-        _raw_params = auth.sub(TOKEN_REGEX, "").split(/\s*#{AUTHN_PAIR_DELIMITERS}\s*/)
+        _raw_params = auth.sub(TOKEN_REGEX, "").split(AUTHN_PAIR_DELIMITERS).map(&:strip)
+        _raw_params.reject!(&:empty?)
 
         if !_raw_params.first&.start_with?(TOKEN_KEY)
           _raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}"

data/lib/action_dispatch/http/filter_parameters.rb

@@ -58,12 +58,17 @@ module ActionDispatch
         ActiveSupport::ParameterFilter.new(filters)
       end
 
-      KV_RE   = "[^&;=]+"
-      PAIR_RE = %r{(#{KV_RE})=(#{KV_RE})}
       def filtered_query_string # :doc:
-        query_string.gsub(PAIR_RE) do |_|
-          parameter_filter.filter($1 => $2).first.join("=")
+        parts = query_string.split(/([&;])/)
+        filtered_parts = parts.map do |part|
+          if part.include?("=")
+            key, value = part.split("=", 2)
+            parameter_filter.filter(key => value).first.join("=")
+          else
+            part
+          end
         end
+        filtered_parts.join("")
       end
     end
   end

data/lib/action_dispatch/http/permissions_policy.rb

@@ -37,7 +37,6 @@ module ActionDispatch # :nodoc:
         request = ActionDispatch::Request.new(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         if policy = request.permissions_policy
@@ -52,12 +51,6 @@ module ActionDispatch # :nodoc:
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[CONTENT_TYPE]
-            /html/.match?(content_type)
-          end
-        end
-
         def policy_present?(headers)
           headers[POLICY]
         end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 0
     TINY  = 8
-    PRE   = "3"
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.0.8.3
+  version: 7.0.8.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-17 00:00:00.000000000 Z
+date: 2024-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.3
+        version: 7.0.8.5
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,10 +310,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.3/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.8.3/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.5/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.8.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.3/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.5/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -331,7 +331,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.5.10
+rubygems_version: 3.5.16
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).