actionview 5.2.4 → 5.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e94b21d68f5daeb4f7bf8727c7f89f7e3bacb9ea29633f798400728408b3265
-  data.tar.gz: cb460ca02808f6935cc737c75c31f126eec9c8d8cf50c14ae963c40b821d1c7f
+  metadata.gz: 7c9ded984056c842554fab54d47aa905a1608850275e62f42ffbdaa9f6b9678b
+  data.tar.gz: 7757657de6c7b78b852e154a9e4e5cb9f97e23dafc5315b92f7a7965d46bf81b
 SHA512:
-  metadata.gz: 4a5ce41a3ade8b1097d8130ff1129e040b0a9a0a89dae5c81c6ec0b216baea8b408a99ea1e8902dde7092194e4df78f1bedc01f487a4a74b713c9494bd808e9d
-  data.tar.gz: 3bd5a09c2ba16f20938d2d4ef0d21aebfea1ca226da1fc409c8a7df60f76b5d86027c729bc1c6b0ec92519755f98126512a7876a71397444264e231e3f82180a
+  metadata.gz: 9309b8503b260efa316d74e478f06310af4339e6b304cf2a8debb4dc833907f260ac2956e38dc1c01652a5739c7ddb19acf8fbfd7845247e9eb8e0fa3803ed7e
+  data.tar.gz: f2152a3e5897a172602b7340721c58825addba9d13d5fcf42c0aa253524e323caa50eda7d532b5a792c471872f165e3d8c049bf8255150095133beb758e7899f

data/CHANGELOG.md

@@ -1,3 +1,39 @@
+## Rails 5.2.5 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.5 (February 10, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.4 (September 09, 2020) ##
+
+*   [CVE-2020-15169] Fix potential XSS vulnerability in the `translate`/`t` helper
+
+    *Jonathan Hefner*
+
+
+## Rails 5.2.4.3 (May 18, 2020) ##
+
+*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+
+
+## Rails 5.2.4.2 (March 19, 2020) ##
+
+*   Fix possible XSS vector in `escape_javascript` helper
+
+    CVE-2020-5267
+
+    *Aaron Patterson*
+
+
+## Rails 5.2.4.1 (December 18, 2019) ##
+
+*   No changes.
+
+
 ## Rails 5.2.4 (November 27, 2019) ##
 
 *   Allow programmatic click events to trigger Rails UJS click handlers.

data/lib/action_view/gem_version.rb

@@ -9,7 +9,7 @@ module ActionView
   module VERSION
     MAJOR = 5
     MINOR = 2
-    TINY  = 4
+    TINY  = 5
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/action_view/helpers/javascript_helper.rb

@@ -12,7 +12,9 @@ module ActionView
         "\n"    => '\n',
         "\r"    => '\n',
         '"'     => '\\"',
-        "'"     => "\\'"
+        "'"     => "\\'",
+        "`"     => "\\`",
+        "$"     => "\\$"
       }
 
       JS_ESCAPE_MAP["\342\200\250".dup.force_encoding(Encoding::UTF_8).encode!] = "
"
@@ -26,7 +28,7 @@ module ActionView
       #   $('some_element').replaceWith('<%= j render 'some/element_template' %>');
       def escape_javascript(javascript)
         if javascript
-          result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) { |match| JS_ESCAPE_MAP[match] }
+          result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u) { |match| JS_ESCAPE_MAP[match] }
           javascript.html_safe? ? result.html_safe : result
         else
           ""

data/lib/action_view/helpers/translation_helper.rb

@@ -79,14 +79,22 @@ module ActionView
 
         if html_safe_translation_key?(key)
           html_safe_options = options.dup
+
           options.except(*I18n::RESERVED_KEYS).each do |name, value|
             unless name == :count && value.is_a?(Numeric)
               html_safe_options[name] = ERB::Util.html_escape(value.to_s)
             end
           end
+
+          html_safe_options[:default] = MISSING_TRANSLATION unless html_safe_options[:default].blank?
+
           translation = I18n.translate(scope_key_by_partial(key), html_safe_options.merge(raise: i18n_raise))
 
-          translation.respond_to?(:html_safe) ? translation.html_safe : translation
+          if translation.equal?(MISSING_TRANSLATION)
+            options[:default].first
+          else
+            translation.respond_to?(:html_safe) ? translation.html_safe : translation
+          end
         else
           I18n.translate(scope_key_by_partial(key), options.merge(raise: i18n_raise))
         end
@@ -121,6 +129,9 @@ module ActionView
       alias :l :localize
 
       private
+        MISSING_TRANSLATION = Object.new
+        private_constant :MISSING_TRANSLATION
+
         def scope_key_by_partial(key)
           if key.to_s.first == "."
             if @virtual_path

data/lib/assets/compiled/rails-ujs.js

@@ -247,8 +247,8 @@ Released under the MIT license
         }
         if (!options.crossDomain) {
           xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+          CSRFProtection(xhr);
         }
-        CSRFProtection(xhr);
         xhr.withCredentials = !!options.withCredentials;
         xhr.onreadystatechange = function() {
           if (xhr.readyState === XMLHttpRequest.DONE) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 5.2.4
+  version: 5.2.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-27 00:00:00.000000000 Z
+date: 2021-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.4
+        version: 5.2.5
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -230,8 +230,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.4/actionview
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.4/actionview/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.5/actionview
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.5/actionview/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -248,7 +248,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).