actionpack 7.0.8 → 7.0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 554db7a8936fc5a1d81baf26f67a4d031f2e7b3c01022695ae842c4a06aa3085
-  data.tar.gz: ceb0aad8f1a9abb47bf6bdc79740dc772cbbbd5d06513f9b19e3dae9d77f1c3b
+  metadata.gz: 9c187c6dc06f7cfe2c9eb4fce7787e7f0f8a0f2ecbed6e3f58937b60d641239c
+  data.tar.gz: f8f4e0b1e8f19bf48fd714ac2f15ce18b4fb0c72ff25472c25dc7881579a798a
 SHA512:
-  metadata.gz: d6a7fcc80e5f12c8eac3ba474094cf9087049389793f2953e49d25b3519637329bf8ab440e2af2c8427acbf79d1b6e67204e1e907cc8d9ce3bc7ab9ff65e5e89
-  data.tar.gz: dfed11835f0aa991c57841aba4ae0a1def553bf086de35bc86db01f2b4424cb9d29823fff6f07ad2fabcc7cc15d752cf7c8b488cf4bf48300ca338e56c8abe2c
+  metadata.gz: e77d65ccbb57cfa58561d235e6d02704fe7bdb7b977f9e229e1f1149e6b3464e37238e2e8485e345bc77f79487b0e383bff81758afdd315370f4ac750957e93b
+  data.tar.gz: c00d8015d6861e927b9d887af3001762940d61ebd9268efda856efe92b3e483d047d9b6ea144096d4c7ae3de229dfb69341ad170a281f1014058a623e75d9f9e

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Rails 7.0.8.1 (February 21, 2024) ##
+
+*   Fix possible XSS vulnerability with the `translate` method in controllers
+
+    CVE-2024-26143
+
 ## Rails 7.0.8 (September 09, 2023) ##
 
 *   Fix `HostAuthorization` potentially displaying the value of the

data/lib/abstract_controller/translation.rb

@@ -25,7 +25,25 @@ module AbstractController
 
       i18n_raise = options.fetch(:raise, self.raise_on_missing_translations)
 
-      ActiveSupport::HtmlSafeTranslation.translate(key, **options, raise: i18n_raise)
+      if options[:default]
+        options[:default] = [options[:default]] unless options[:default].is_a?(Array)
+        options[:default] = options[:default].map do |value|
+          value.is_a?(String) ? ERB::Util.html_escape(value) : value
+        end
+      end
+
+      unless i18n_raise
+        options[:default] = [] unless options[:default]
+        options[:default] << MISSING_TRANSLATION
+      end
+
+      result = ActiveSupport::HtmlSafeTranslation.translate(key, **options, raise: i18n_raise)
+
+      if result == MISSING_TRANSLATION
+        +"translation missing: #{key}"
+      else
+        result
+      end
     end
     alias :t :translate
 
@@ -34,5 +52,9 @@ module AbstractController
       I18n.localize(object, **options)
     end
     alias :l :localize
+
+    private
+      MISSING_TRANSLATION = -(2**60)
+      private_constant :MISSING_TRANSLATION
   end
 end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 0
     TINY  = 8
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.0.8
+  version: 7.0.8.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-09-09 00:00:00.000000000 Z
+date: 2024-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8
+        version: 7.0.8.1
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,10 +310,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.8/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.8/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.1/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.8.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.8/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.1/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -331,7 +331,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.4.18
+rubygems_version: 3.2.22
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).