actionview 4.2.11.1 → 4.2.11.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71fb7b73001ccc9220ba0da089fc3336a3a18620ca13a18730fa91d4799fbf58
-  data.tar.gz: a87ef6a72900a81c7cff2d00f3fac65006c0f95935b7bf366c1f4bfa1210b6d1
+  metadata.gz: 35fcfe997dc7203fb3f98d02246095f8dc4a6f04dcc55202b0e7c46103f5ea6f
+  data.tar.gz: d847aabe2601aabc3d08859d1c50dd05b3d9e6948308d7021de3e76826667beb
 SHA512:
-  metadata.gz: ea93cb6a5de3af579900cf1534b50842c6d197062ee7a01a9f499287dbbb8f6f3d9c32abfadba3c2d1868b8deddc70594c3e5767744031e47961d5da15cb5e54
-  data.tar.gz: e59b44cf756ed5bf55ef96709055a04413dfba03fa083c32ef709eb266267ac774bc7d83c08c696a16c98e5dd93a412a531372eee7546bcc8e856e1304dcf618
+  metadata.gz: d4b7cc1695c4ae8fa02deac117be9b6d174859d2f197e91f78ffacc9ed0be7aa80900ebd1634a9c34393e42b95249da20c82b63fb3c55e93e3ba69c41c4f0efd
+  data.tar.gz: aee0806ac9e39e97d731f002c117686099436cf3b7c119c52ff33c08a3fa71fbca9e2c5461dbb3129be537f0ed9ac03fcb7dcd5bc804fd3f0066fc09ae740eaa

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## Rails 4.2.11.3 (May 15, 2020) ##
+
+*   Backport a missing commit for [CVE-2020-8163]
+
+
+## Rails 4.2.11.2 (May 15, 2020) ##
+
+*   Restrict local variable names in templates [CVE-2020-8163]
+
+
 ## Rails 4.2.11.1 (March 11, 2019) ##
 
 *   No changes.

data/lib/action_view/gem_version.rb

@@ -8,7 +8,7 @@ module ActionView
     MAJOR = 4
     MINOR = 2
     TINY  = 11
-    PRE   = "1"
+    PRE   = "3"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/template.rb

@@ -312,8 +312,12 @@ module ActionView
       end
 
       def locals_code #:nodoc:
+        # Only locals with valid variable names get set directly. Others will
+        # still be available in local_assigns.
+        locals = @locals.to_set - Module::DELEGATION_RESERVED_METHOD_NAMES
+        locals = locals.grep(/\A(?![A-Z0-9])(?:[[:alnum:]_]|[^\0-\177])+\z/)
         # Double assign to suppress the dreaded 'assigned but unused variable' warning
-        @locals.each_with_object('') { |key, code| code << "#{key} = #{key} = local_assigns[:#{key}];" }
+        locals.each_with_object('') { |key, code| code << "#{key} = #{key} = local_assigns[:#{key}];" }
       end
 
       def method_name #:nodoc:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 4.2.11.1
+  version: 4.2.11.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-11 00:00:00.000000000 Z
+date: 2020-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.11.1
+        version: 4.2.11.3
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -247,7 +247,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.0.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).