actionpack 3.1.9 → 3.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 !binary "U0hBMQ==":
-  metadata.gz: 30b727e1c49903c1015968d3dfee8ec171c730c4
-  data.tar.gz: 64fbd9f755c1b098832d11be6e08dde202ee7298
+  metadata.gz: 90968dc970e80ff89a11d7d2aa97c5cfa67bbf7b
+  data.tar.gz: 0d05b45c288729d7a5e17cd7df18fe652f1d6429
 !binary "U0hBNTEy":
-  metadata.gz: 03249e735f5e4dcddff6df4341226669b3062f99ed32e46016f2e6bc84182a7649c21a3127898ad41a47240d1003614763f865b0971c4e5f3c364e130cfbe55f
-  data.tar.gz: e8c364f08a7e2737f2489cf4bb286bfbcde66e67a0903577c27d088ec103460eac83a334e7a8a96b3004a50381e441e739e67b52d55f959143e5171d50cf0713
+  metadata.gz: e3ab880006ca03db0c7f425582637ff5aa4f00680d80fcf4007f60645f5c1a20d96635332ea3a1592fcef55f35a9e184177df6ef43e2f9f97a79842885f2823d
+  data.tar.gz: ce0c161b8ac8343f61f5dba717f7028340d8a5c833d238fb9b33faa3d2b1cc862dc708d08cd8fe036ecc1b8056b32b7a90ad47d752772f4d3bc0d8f1694f5e48

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Rails 3.1.10
+
+* Strip nils from collections on JSON and XML posts. [CVE-2013-0155]
+
 ## Rails 3.1.9
 
 ## Rails 3.1.8 (Aug 9, 2012)

data/lib/action_dispatch/http/request.rb

@@ -267,18 +267,14 @@ module ActionDispatch
       LOCALHOST.any? { |local_ip| local_ip === remote_addr && local_ip === remote_ip }
     end
 
-    protected
-
     # Remove nils from the params hash
     def deep_munge(hash)
-      keys = hash.keys.find_all { |k| hash[k] == [nil] }
-      keys.each { |k| hash[k] = nil }
-
-      hash.each_value do |v|
+      hash.each do |k, v|
         case v
         when Array
           v.grep(Hash) { |x| deep_munge(x) }
           v.compact!
+          hash[k] = nil if v.empty?
         when Hash
           deep_munge(v)
         end
@@ -287,6 +283,8 @@ module ActionDispatch
       hash
     end
 
+    protected
+
     def parse_query(qs)
       deep_munge(super)
     end

data/lib/action_dispatch/middleware/params_parser.rb

@@ -38,13 +38,13 @@ module ActionDispatch
         when Proc
           strategy.call(request.raw_post)
         when :xml_simple, :xml_node
-          data = Hash.from_xml(request.body.read) || {}
+          data = request.deep_munge(Hash.from_xml(request.body.read) || {})
           request.body.rewind if request.body.respond_to?(:rewind)
           data.with_indifferent_access
         when :yaml
           YAML.load(request.raw_post)
         when :json
-          data = ActiveSupport::JSON.decode(request.body)
+          data = request.deep_munge ActiveSupport::JSON.decode(request.body)
           request.body.rewind if request.body.respond_to?(:rewind)
           data = {:_json => data} unless data.is_a?(Hash)
           data.with_indifferent_access

data/lib/action_dispatch/middleware/session/abstract_store.rb

@@ -25,6 +25,8 @@ module ActionDispatch
     module Compatibility
       def initialize(app, options = {})
         options[:key] ||= '_session_id'
+        # FIXME Rack's secret is not being used
+        options[:secret] ||= SecureRandom.hex(30)
         super
       end
 

data/lib/action_pack/version.rb

@@ -2,7 +2,7 @@ module ActionPack
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 1
-    TINY  = 9
+    TINY  = 10
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 3.1.9
+  version: 3.1.10
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-23 00:00:00.000000000 Z
+date: 2013-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.9
+        version: 3.1.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.9
+        version: 3.1.10
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.9
+        version: 3.1.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.9
+        version: 3.1.10
 - !ruby/object:Gem::Dependency
   name: rack-cache
   requirement: !ruby/object:Gem::Requirement
@@ -379,7 +379,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - none
 rubyforge_project: 
-rubygems_version: 2.0.0.preview2.1
+rubygems_version: 2.0.0.preview3
 signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).