actiontext 7.1.3.3 → 7.1.3.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/app/helpers/action_text/content_helper.rb +9 -0
- data/lib/action_text/content.rb +2 -1
- data/lib/action_text/gem_version.rb +1 -1
- data/package.json +1 -1
- metadata +14 -14
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: d51a41ff03b550ac428a52ce89ee785539d2ac0b386c5597f4c06b763070d054
|
4
|
+
data.tar.gz: 85028cdc38e4448c321e17190924c602f7bd940588307ef42206c7e0842ba31a
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 417dec3ad3e197b566e52b5b42356481d6a5f54e1a792b5f16c7eeaa45137b2a4bdeeb32e83fd890d884fc60864e7d6062ebe25115710a40de06df3c93812c95
|
7
|
+
data.tar.gz: ab1691bf97b79a8f2b644b6bf324c06fc663fd8ca2ba4641a906fcf7062a4c4acb4103b25b405561fc21e81198ce7b7541a9d02921d137ae14de6eb75d01b1c7
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,9 @@
|
|
1
|
+
## Rails 7.1.3.4 (June 04, 2024) ##
|
2
|
+
|
3
|
+
* Sanitize ActionText HTML ContentAttachment in Trix edit view
|
4
|
+
[CVE-2024-32464]
|
5
|
+
|
6
|
+
|
1
7
|
## Rails 7.1.3.3 (May 16, 2024) ##
|
2
8
|
|
3
9
|
* Upgrade Trix to 1.3.2 to fix [CVE-2024-34341](https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99).
|
@@ -14,6 +14,15 @@ module ActionText
|
|
14
14
|
sanitize_action_text_content(render_action_text_attachments(content))
|
15
15
|
end
|
16
16
|
|
17
|
+
def sanitize_content_attachment(content_attachment)
|
18
|
+
sanitizer.sanitize(
|
19
|
+
content_attachment,
|
20
|
+
tags: sanitizer_allowed_tags,
|
21
|
+
attributes: sanitizer_allowed_attributes,
|
22
|
+
scrubber: scrubber,
|
23
|
+
)
|
24
|
+
end
|
25
|
+
|
17
26
|
def sanitize_action_text_content(content)
|
18
27
|
sanitizer.sanitize(
|
19
28
|
content.to_html,
|
data/lib/action_text/content.rb
CHANGED
@@ -20,7 +20,7 @@ module ActionText
|
|
20
20
|
# body.to_s # => "<h1>Funny times!</h1>"
|
21
21
|
# body.to_plain_text # => "Funny times!"
|
22
22
|
class Content
|
23
|
-
include Rendering, Serialization
|
23
|
+
include Rendering, Serialization, ContentHelper
|
24
24
|
|
25
25
|
attr_reader :fragment
|
26
26
|
|
@@ -94,6 +94,7 @@ module ActionText
|
|
94
94
|
|
95
95
|
def render_attachments(**options, &block)
|
96
96
|
content = fragment.replace(ActionText::Attachment.tag_name) do |node|
|
97
|
+
node["content"] = sanitize_content_attachment(node["content"])
|
97
98
|
block.call(attachment_for_node(node, **options))
|
98
99
|
end
|
99
100
|
self.class.new(content, canonicalize: false)
|
data/package.json
CHANGED
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: actiontext
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 7.1.3.
|
4
|
+
version: 7.1.3.4
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Javan Makhmali
|
@@ -10,7 +10,7 @@ authors:
|
|
10
10
|
autorequire:
|
11
11
|
bindir: bin
|
12
12
|
cert_chain: []
|
13
|
-
date: 2024-
|
13
|
+
date: 2024-06-04 00:00:00.000000000 Z
|
14
14
|
dependencies:
|
15
15
|
- !ruby/object:Gem::Dependency
|
16
16
|
name: activesupport
|
@@ -18,56 +18,56 @@ dependencies:
|
|
18
18
|
requirements:
|
19
19
|
- - '='
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version: 7.1.3.
|
21
|
+
version: 7.1.3.4
|
22
22
|
type: :runtime
|
23
23
|
prerelease: false
|
24
24
|
version_requirements: !ruby/object:Gem::Requirement
|
25
25
|
requirements:
|
26
26
|
- - '='
|
27
27
|
- !ruby/object:Gem::Version
|
28
|
-
version: 7.1.3.
|
28
|
+
version: 7.1.3.4
|
29
29
|
- !ruby/object:Gem::Dependency
|
30
30
|
name: activerecord
|
31
31
|
requirement: !ruby/object:Gem::Requirement
|
32
32
|
requirements:
|
33
33
|
- - '='
|
34
34
|
- !ruby/object:Gem::Version
|
35
|
-
version: 7.1.3.
|
35
|
+
version: 7.1.3.4
|
36
36
|
type: :runtime
|
37
37
|
prerelease: false
|
38
38
|
version_requirements: !ruby/object:Gem::Requirement
|
39
39
|
requirements:
|
40
40
|
- - '='
|
41
41
|
- !ruby/object:Gem::Version
|
42
|
-
version: 7.1.3.
|
42
|
+
version: 7.1.3.4
|
43
43
|
- !ruby/object:Gem::Dependency
|
44
44
|
name: activestorage
|
45
45
|
requirement: !ruby/object:Gem::Requirement
|
46
46
|
requirements:
|
47
47
|
- - '='
|
48
48
|
- !ruby/object:Gem::Version
|
49
|
-
version: 7.1.3.
|
49
|
+
version: 7.1.3.4
|
50
50
|
type: :runtime
|
51
51
|
prerelease: false
|
52
52
|
version_requirements: !ruby/object:Gem::Requirement
|
53
53
|
requirements:
|
54
54
|
- - '='
|
55
55
|
- !ruby/object:Gem::Version
|
56
|
-
version: 7.1.3.
|
56
|
+
version: 7.1.3.4
|
57
57
|
- !ruby/object:Gem::Dependency
|
58
58
|
name: actionpack
|
59
59
|
requirement: !ruby/object:Gem::Requirement
|
60
60
|
requirements:
|
61
61
|
- - '='
|
62
62
|
- !ruby/object:Gem::Version
|
63
|
-
version: 7.1.3.
|
63
|
+
version: 7.1.3.4
|
64
64
|
type: :runtime
|
65
65
|
prerelease: false
|
66
66
|
version_requirements: !ruby/object:Gem::Requirement
|
67
67
|
requirements:
|
68
68
|
- - '='
|
69
69
|
- !ruby/object:Gem::Version
|
70
|
-
version: 7.1.3.
|
70
|
+
version: 7.1.3.4
|
71
71
|
- !ruby/object:Gem::Dependency
|
72
72
|
name: nokogiri
|
73
73
|
requirement: !ruby/object:Gem::Requirement
|
@@ -163,10 +163,10 @@ licenses:
|
|
163
163
|
- MIT
|
164
164
|
metadata:
|
165
165
|
bug_tracker_uri: https://github.com/rails/rails/issues
|
166
|
-
changelog_uri: https://github.com/rails/rails/blob/v7.1.3.
|
167
|
-
documentation_uri: https://api.rubyonrails.org/v7.1.3.
|
166
|
+
changelog_uri: https://github.com/rails/rails/blob/v7.1.3.4/actiontext/CHANGELOG.md
|
167
|
+
documentation_uri: https://api.rubyonrails.org/v7.1.3.4/
|
168
168
|
mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
|
169
|
-
source_code_uri: https://github.com/rails/rails/tree/v7.1.3.
|
169
|
+
source_code_uri: https://github.com/rails/rails/tree/v7.1.3.4/actiontext
|
170
170
|
rubygems_mfa_required: 'true'
|
171
171
|
post_install_message:
|
172
172
|
rdoc_options: []
|
@@ -183,7 +183,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
183
183
|
- !ruby/object:Gem::Version
|
184
184
|
version: '0'
|
185
185
|
requirements: []
|
186
|
-
rubygems_version: 3.
|
186
|
+
rubygems_version: 3.3.27
|
187
187
|
signing_key:
|
188
188
|
specification_version: 4
|
189
189
|
summary: Rich text framework.
|