actionpack 6.0.3.4 → 6.0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3767927eaf2709c272ca4da197a4e356dbd7d4fffaf78a10eb4f4f9ee5b0d0d
-  data.tar.gz: cf187c693653a55c75afd103afc829422ea107936e03aabddb594ac52f6cfad8
+  metadata.gz: 5203f7e82a9df250415584df22acab73cd81df0958ba9f6dc5c46c7a3932cd6b
+  data.tar.gz: d700bbc8d27192eab2a962dd44119c1bd95115b5a037ee2c6808dd90519828f3
 SHA512:
-  metadata.gz: 3b93fe304a8ec1ed90fc09a076fd54d6beee63fff8e7594e4b71c0c67b57515f0c53f9ac11435ca7f81940dd03b17a671f6b5d1065d2c063d6c40fe367a5808e
-  data.tar.gz: ec62a4e0f89af114bfe4d00e88ca875fec9c2f68f81ee1fd27aef57629ea0e2680968b5a10d092813b054c55b4c654cf0b57dd029d4d55bfaf4fb1f3ba409176
+  metadata.gz: 8e9d74012757c217e092bd3ee0a9b6f6c5cb0ddcd3756166090dc108a09f02287fd964bb8a2729cdb7db78b8206f44de3dfd63238321027b449b926e279ce671
+  data.tar.gz: 5c32c82aa600ca697666a78db8bfa7a15cde7f8ef702b79043fb5b73e8a7c8a12ad654161e9d9d6ce311e9954d8fa0100de0910266d7e0ef2976789723e0bda5

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   Prevent open redirect when allowed host starts with a dot
+
+    [CVE-2021-22881]
+
+    Thanks to @tktech (https://hackerone.com/tktech) for reporting this
+    issue and the patch!
+
+    *Aaron Patterson*
+
+
 ## Rails 6.0.3.4 (October 07, 2020) ##
 
 *   [CVE-2020-8264] Prevent XSS in Actionable Exceptions

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -87,11 +87,20 @@ module ActionDispatch
 
     private
       def authorized?(request)
-        origin_host = request.get_header("HTTP_HOST").to_s.sub(/:\d+\z/, "")
-        forwarded_host = request.x_forwarded_host.to_s.split(/,\s?/).last.to_s.sub(/:\d+\z/, "")
-
-        @permissions.allows?(origin_host) &&
-          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
+        valid_host = /
+          \A
+          (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9\.:]+\])
+          (:\d+)?
+          \z
+        /x
+
+        origin_host = valid_host.match(
+          request.get_header("HTTP_HOST").to_s.downcase)
+        forwarded_host = valid_host.match(
+          request.x_forwarded_host.to_s.split(/,\s?/).last)
+
+        origin_host && @permissions.allows?(origin_host[:host]) && (
+          forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
       end
 
       def mark_as_authorized(request)

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = "4"
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.0.3.4
+  version: 6.0.3.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-07 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,11 +310,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.4/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3.4/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.5/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.4/actionpack
-post_install_message:
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.5/actionpack
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -330,8 +330,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.0.3
+signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []