actionpack 3.2.10 → 3.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 !binary "U0hBMQ==":
-  metadata.gz: e93042eba846d70b2702aa517c6cbba339a6f6c5
-  data.tar.gz: 1fd021147ff9f8b3f9acbf927fc56c6aa2f9d524
+  metadata.gz: 3a07abaffe43401851fb7bc9cc90467c560ad121
+  data.tar.gz: b12c03bbd8aee1fd54d33723a57bbb31bdc78f81
 !binary "U0hBNTEy":
-  metadata.gz: b341980f8e716a24abf16c815bb4b9aff078af4a2955729fb3b9c91718cef25bb9f2e6242df26fac7a6808af4a8378bdb5b837657a3d60be75707812838ccd77
-  data.tar.gz: f29b74dcc1fb04c0651bd88a9422d3a9f5fd80929cad64e6f6db62e9e193325849d61496bf30a2fe154e6197cbc4d00e46460fc8aa5a8f862238e503ae034a48
+  metadata.gz: 1492eaab5dbca1b9683b3ac9277e18dbc9e135366e19b98e98d27542042636b13afb513fa77d9a0809c537a943f583e94644bb90562b110ab3a0d79ddd135b70
+  data.tar.gz: 8e5a41925674a956188a1d4aaeee4389bc775aa7373c9b2dc1e84b76d594fe54b4ef80d126892a60ab6fb3e4530734897bf1aeb5dea43016854dfc4594e9f297

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Rails 3.2.11 ##
+
+* Strip nils from collections on JSON and XML posts. [CVE-2013-0155]
+
 ## Rails 3.2.10 ##
 
 ## Rails 3.2.9 (Nov 12, 2012) ##

data/lib/action_dispatch/http/request.rb

@@ -247,18 +247,14 @@ module ActionDispatch
       LOCALHOST.any? { |local_ip| local_ip === remote_addr && local_ip === remote_ip }
     end
 
-    protected
-
     # Remove nils from the params hash
     def deep_munge(hash)
-      keys = hash.keys.find_all { |k| hash[k] == [nil] }
-      keys.each { |k| hash[k] = nil }
-
-      hash.each_value do |v|
+      hash.each do |k, v|
         case v
         when Array
           v.grep(Hash) { |x| deep_munge(x) }
           v.compact!
+          hash[k] = nil if v.empty?
         when Hash
           deep_munge(v)
         end
@@ -267,6 +263,8 @@ module ActionDispatch
       hash
     end
 
+    protected
+
     def parse_query(qs)
       deep_munge(super)
     end

data/lib/action_dispatch/middleware/params_parser.rb

@@ -38,13 +38,13 @@ module ActionDispatch
         when Proc
           strategy.call(request.raw_post)
         when :xml_simple, :xml_node
-          data = Hash.from_xml(request.body.read) || {}
+          data = request.deep_munge(Hash.from_xml(request.body.read) || {})
           request.body.rewind if request.body.respond_to?(:rewind)
           data.with_indifferent_access
         when :yaml
           YAML.load(request.raw_post)
         when :json
-          data = ActiveSupport::JSON.decode(request.body)
+          data = request.deep_munge ActiveSupport::JSON.decode(request.body)
           request.body.rewind if request.body.respond_to?(:rewind)
           data = {:_json => data} unless data.is_a?(Hash)
           data.with_indifferent_access

data/lib/action_dispatch/middleware/session/abstract_store.rb

@@ -25,6 +25,8 @@ module ActionDispatch
     module Compatibility
       def initialize(app, options = {})
         options[:key] ||= '_session_id'
+        # FIXME Rack's secret is not being used
+        options[:secret] ||= SecureRandom.hex(30)
         super
       end
 

data/lib/action_pack/version.rb

@@ -2,7 +2,7 @@ module ActionPack
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 10
+    TINY  = 11
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 3.2.10
+  version: 3.2.11
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-23 00:00:00.000000000 Z
+date: 2013-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.10
+        version: 3.2.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.10
+        version: 3.2.11
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.10
+        version: 3.2.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.10
+        version: 3.2.11
 - !ruby/object:Gem::Dependency
   name: rack-cache
   requirement: !ruby/object:Gem::Requirement
@@ -368,7 +368,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - none
 rubyforge_project: 
-rubygems_version: 2.0.0.preview2.1
+rubygems_version: 2.0.0.preview3
 signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).