actionpack 7.0.8.4 → 7.0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 401770d290571f4e04cb3dd9eb8907310a1f32333d98dcc2c81086efbad0c5ea
-  data.tar.gz: 84622dc210bb7abbcb33104f18e810697d4988f1b7327a1a11bceeaaba92feea
+  metadata.gz: 674d7ab95a19a8e20618b674de61f05a16b8525904ec04088b9e51c35ec57910
+  data.tar.gz: 4e118b499335d173215d2012baa270e03ba10fa683b663b25ab5e656e7d28608
 SHA512:
-  metadata.gz: 0f14a00f906e304b91efa5bf25a5ef3b51e379dc7a002d60c729ae383d04e87c5b4abab2c6057355a4760ef11ade5c969ac03e5a5473b74edc83ab8d238e4968
-  data.tar.gz: c3ef7f7058d635efbeab9d23f95c11727db0ec126f557a5c1e7e4cbb8290e31e18cff94457bc22aadcf474a45d2522f04f0188d3175c15e48f2d6689c3cf7d81
+  metadata.gz: 5df4f331a6622ab1286b48b3588f9475b7ed6132c7a6063e50306170634aba0affa2ab1401581dbbfab898553d7b92b34cb1e3987fc100a8956a2255a5cb91fa
+  data.tar.gz: da8be10bca3b1ec2379d39b7bcc70639621bd86c0922e4422efa76560d0de65775bd997e9b9edf00f9eb2acd9889044aaa451fa11d33f8da02982affe9c64adb

data/CHANGELOG.md

@@ -1,3 +1,14 @@
+## Rails 7.0.8.5 (October 15, 2024) ##
+
+*   Avoid regex backtracking in HTTP Token authentication
+
+    [CVE-2024-47887]
+
+*   Avoid regex backtracking in query parameter filtering
+
+    [CVE-2024-41128]
+
+
 ## Rails 7.0.8.4 (June 04, 2024) ##
 
 *   Include the HTTP Permissions-Policy on non-HTML Content-Types

data/lib/action_controller/metal/http_authentication.rb

@@ -506,7 +506,8 @@ module ActionController
       # pairs by the standardized <tt>:</tt>, <tt>;</tt>, or <tt>\t</tt>
       # delimiters defined in +AUTHN_PAIR_DELIMITERS+.
       def raw_params(auth)
-        _raw_params = auth.sub(TOKEN_REGEX, "").split(/\s*#{AUTHN_PAIR_DELIMITERS}\s*/)
+        _raw_params = auth.sub(TOKEN_REGEX, "").split(AUTHN_PAIR_DELIMITERS).map(&:strip)
+        _raw_params.reject!(&:empty?)
 
         if !_raw_params.first&.start_with?(TOKEN_KEY)
           _raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}"

data/lib/action_dispatch/http/filter_parameters.rb

@@ -58,12 +58,17 @@ module ActionDispatch
         ActiveSupport::ParameterFilter.new(filters)
       end
 
-      KV_RE   = "[^&;=]+"
-      PAIR_RE = %r{(#{KV_RE})=(#{KV_RE})}
       def filtered_query_string # :doc:
-        query_string.gsub(PAIR_RE) do |_|
-          parameter_filter.filter($1 => $2).first.join("=")
+        parts = query_string.split(/([&;])/)
+        filtered_parts = parts.map do |part|
+          if part.include?("=")
+            key, value = part.split("=", 2)
+            parameter_filter.filter(key => value).first.join("=")
+          else
+            part
+          end
         end
+        filtered_parts.join("")
       end
     end
   end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 7
     MINOR = 0
     TINY  = 8
-    PRE   = "4"
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.0.8.4
+  version: 7.0.8.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-04 00:00:00.000000000 Z
+date: 2024-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.8.4
+        version: 7.0.8.5
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -310,10 +310,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.4/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.8.4/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.8.5/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.8.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.4/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.8.5/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -331,7 +331,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.3.27
+rubygems_version: 3.5.16
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).