actionpack 6.0.4 → 6.0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 678219232b512e4e26f212b806cdf7b43bd5659acea529b2b28e2c302abbfced
-  data.tar.gz: c2069babda9aba85e6fd8d2f922803909877c06b8a0c3a3597dc51b1de411924
+  metadata.gz: a1ce7e505c443ac3626576f8ee7d9f877df0f805a2f200993f67d377ffb39637
+  data.tar.gz: 63c9a462a845c3775f90d60d4a7554c3ec67c9090d67199210cf9978f8117469
 SHA512:
-  metadata.gz: 43e407ce89353f04be46d92411267bc9eb3dc52a95578f5f7d9b5800a06f89b729fd9be33939792b1e9b56e702a13be4117d9303f4ce62e6d740da89c6d51137
-  data.tar.gz: a0f47e4c5f9a88be9566030b9b69566d8ba11f796adf9b4684e4fbee0617ebfb0e60c1f700b5b52c311959dfe192ba1bca21db64398f6988faf0eca48538a232
+  metadata.gz: b38a9f6e715de35d394eae37a599abf39e277b3f87916b648ede6489d499c9c638408f6d874eb47a22ce1b1fcf6eeac682125bbec92881b90002baf838df0e7e
+  data.tar.gz: 28abb4b6e0e463cba47474ea4e2c7d6c5fded3f4bace5853a32acdfd36bc0ebcaa699ea5c7444c5ca9a98210d23f7d63660c9237ba0389ffe2647e22d95d52e3

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## Rails 6.0.4.1 (August 19, 2021) ##
+
+*   [CVE-2021-22942] Fix possible open redirect in Host Authorization middleware.
+
+    Specially crafted "X-Forwarded-Host" headers in combination with certain
+    "allowed host" formats can cause the Host Authorization middleware in Action
+    Pack to redirect users to a malicious website.
+
 ## Rails 6.0.4 (June 15, 2021) ##
 
 *   Accept base64_urlsafe CSRF tokens to make forward compatible.

data/lib/action_dispatch/middleware/host_authorization.rb

@@ -86,21 +86,15 @@ module ActionDispatch
     end
 
     private
+      HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
+      VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
+      VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
+
       def authorized?(request)
-        valid_host = /
-          \A
-          (?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\])
-          (:\d+)?
-          \z
-        /x
-
-        origin_host = valid_host.match(
-          request.get_header("HTTP_HOST").to_s.downcase)
-        forwarded_host = valid_host.match(
-          request.x_forwarded_host.to_s.split(/,\s?/).last)
-
-        origin_host && @permissions.allows?(origin_host[:host]) && (
-          forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
+        origin_host = request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
+        forwarded_host = request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
+
+        @permissions.allows?(origin_host) && (forwarded_host.blank? || @permissions.allows?(forwarded_host))
       end
 
       def mark_as_authorized(request)

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 0
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.0.4
+  version: 6.0.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-15 00:00:00.000000000 Z
+date: 2021-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4
+        version: 6.0.4.1
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,11 +310,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.4/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.4/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.4.1/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.4/actionpack
-post_install_message: 
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.4.1/actionpack
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -330,8 +330,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.2.15
+signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []