actionpack 7.0.8.5 → 7.0.8.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 674d7ab95a19a8e20618b674de61f05a16b8525904ec04088b9e51c35ec57910
-  data.tar.gz: 4e118b499335d173215d2012baa270e03ba10fa683b663b25ab5e656e7d28608
+  metadata.gz: 70dee7a29aa49cddf5164963e3f5686ee864164d8fa28da67bd989d7cdebf4d4
+  data.tar.gz: 7612f71cb68820c1ed4b5c0c6f620f326b30692e34bc9f835cb85c0baa5a0eb2
 SHA512:
-  metadata.gz: 5df4f331a6622ab1286b48b3588f9475b7ed6132c7a6063e50306170634aba0affa2ab1401581dbbfab898553d7b92b34cb1e3987fc100a8956a2255a5cb91fa
-  data.tar.gz: da8be10bca3b1ec2379d39b7bcc70639621bd86c0922e4422efa76560d0de65775bd997e9b9edf00f9eb2acd9889044aaa451fa11d33f8da02982affe9c64adb
+  metadata.gz: c7b71a3f0fa3039dccac396aa80c7f765476de45c59c75a3afb4556b10b3265d80e8105139c6fc45bbfcac09dff851b16850e41e21bfb951d9bcb514ea2f0814
+  data.tar.gz: 3097c2c8ad4ed6f2453f58a5b0c2587e67f120cc18ce94f8dad7ce5d1381cc6d055294a4977a65f148d2f526e188b4a4a5c14b5dde750e042b73438ec32e7674

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## Rails 7.0.8.7 (December 10, 2024) ##
+
+*   Add validation to content security policies to disallow spaces and semicolons.
+    Developers should use multiple arguments, and different directive methods instead.
+
+    [CVE-2024-54133]
+
+    *Gannon McGibbon*
+
+## Rails 7.0.8.6 (October 23, 2024) ##
+
+*   No changes.
+
+
 ## Rails 7.0.8.5 (October 15, 2024) ##
 
 *   Avoid regex backtracking in HTTP Token authentication

data/lib/action_dispatch/http/content_security_policy.rb

@@ -22,6 +22,9 @@ module ActionDispatch # :nodoc:
   #     policy.report_uri "/csp-violation-report-endpoint"
   #   end
   class ContentSecurityPolicy
+    class InvalidDirectiveError < StandardError
+    end
+
     class Middleware
       CONTENT_TYPE = "Content-Type"
       POLICY = "Content-Security-Policy"
@@ -316,9 +319,9 @@ module ActionDispatch # :nodoc:
         @directives.map do |directive, sources|
           if sources.is_a?(Array)
             if nonce && nonce_directive?(directive, nonce_directives)
-              "#{directive} #{build_directive(sources, context).join(' ')} 'nonce-#{nonce}'"
+              "#{directive} #{build_directive(directive, sources, context).join(' ')} 'nonce-#{nonce}'"
             else
-              "#{directive} #{build_directive(sources, context).join(' ')}"
+              "#{directive} #{build_directive(directive, sources, context).join(' ')}"
             end
           elsif sources
             directive
@@ -328,8 +331,22 @@ module ActionDispatch # :nodoc:
         end
       end
 
-      def build_directive(sources, context)
-        sources.map { |source| resolve_source(source, context) }
+      def validate(directive, sources)
+        sources.flatten.each do |source|
+          if source.include?(";") || source != source.gsub(/[[:space:]]/, "")
+            raise InvalidDirectiveError, <<~MSG.squish
+              Invalid Content Security Policy #{directive}: "#{source}".
+              Directive values must not contain whitespace or semicolons.
+              Please use multiple arguments or other directive methods instead.
+            MSG
+          end
+        end
+      end
+
+      def build_directive(directive, sources, context)
+        resolved_sources = sources.map { |source| resolve_source(source, context) }
+
+        validate(directive, resolved_sources)
       end
 
       def resolve_source(source, context)

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 0
     TINY  = 8
-    PRE   = "5"
+    PRE   = "7"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.0.8.5
+  version: 7.0.8.7
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-15 00:00:00.000000000 Z
+date: 2024-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.5
+        version: 7.0.8.7
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,12 +310,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.5/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.8.5/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.7/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.8.7/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.5/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.7/actionpack
   rubygems_mfa_required: 'true'
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -331,8 +331,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.5.16
-signing_key:
+rubygems_version: 3.5.22
+signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []