actionview 6.0.4.7 → 6.0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a02c1e3b3bb79351d1ff2d6ff4e18ac281f735e3c3e9688a0ee980e59467881
-  data.tar.gz: b01d9a6277d2cbc47f4ceeea6c31d4e4b867a44225ac1c28701c9ae1e2996e6d
+  metadata.gz: 7ae06527b9554d55d60951ace58d19621b78d4504a38d85f1611ee1a9159e6e8
+  data.tar.gz: 7739ec7a12cd620ea5334f5f730b875b1d1521e7c9983a4f22ad499840059164
 SHA512:
-  metadata.gz: b1eb31601a70f6b6f70266e61f8279e354f746a62062ac03de88fb995ace71a8dc615bd10b2da0438758672a9efffd82d9d09ef2bfde54f546e21c977a5ce0fc
-  data.tar.gz: a9be61ff408fcb1ed270af84aca45707017800b8a3ec9ff8b1e19e73c6d4d16e632c10749b9475f06ed410bac1c57c0c7a00f033a5a16c134c1cf028461d3aee
+  metadata.gz: b73a0f76f4aea630ef0cd80b18aaec8907842b351d3eca8a72ed256807774fe45af4ef71de6111f0fb7a655e36cd7a086de45d6f8f0ef4af7a63951f9e9eb748
+  data.tar.gz: 29e9ed9c4903f6d712e4b1a12d7e8f6c49d6bc4de6a9ae877605757f159ea20b72a1db3c60c528520102674bc3cf8e48d0a50dd88007cc4b67c423c1fb1caaa7

data/CHANGELOG.md

@@ -1,3 +1,25 @@
+## Rails 6.0.5.1 (July 12, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.0.5 (May 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.0.4.8 (April 26, 2022) ##
+
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
+
+    Escape dangerous characters in names of tags and names of attributes in the
+    tag helpers, following the XML specification. Rename the option
+    `:escape_attributes` to `:escape`, to simplify by applying the option to the
+    whole tag.
+
+    *Álvaro Martín Fraguas*
+
+
 ## Rails 6.0.4.7 (March 08, 2022) ##
 
 *   No changes.

data/lib/action_view/base.rb

@@ -152,7 +152,7 @@ module ActionView #:nodoc:
     # Specify whether rendering within namespaced controllers should prefix
     # the partial paths for ActiveModel objects with the namespace.
     # (e.g., an Admin::PostsController would render @post using /admin/posts/_post.erb)
-    cattr_accessor :prefix_partial_path_with_controller_namespace, default: true
+    class_attribute :prefix_partial_path_with_controller_namespace, default: true
 
     # Specify default_formats that can be rendered.
     cattr_accessor :default_formats

data/lib/action_view/gem_version.rb

@@ -9,8 +9,8 @@ module ActionView
   module VERSION
     MAJOR = 6
     MINOR = 0
-    TINY  = 4
-    PRE   = "7"
+    TINY  = 5
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/tag_helper.rb

@@ -41,18 +41,25 @@ module ActionView
           @view_context = view_context
         end
 
-        def tag_string(name, content = nil, escape_attributes: true, **options, &block)
+        def tag_string(name, content = nil, **options, &block)
+          escape = handle_deprecated_escape_options(options)
           content = @view_context.capture(self, &block) if block_given?
+
           if VOID_ELEMENTS.include?(name) && content.nil?
-            "<#{name.to_s.dasherize}#{tag_options(options, escape_attributes)}>".html_safe
+            "<#{name.to_s.dasherize}#{tag_options(options, escape)}>".html_safe
           else
-            content_tag_string(name.to_s.dasherize, content || "", options, escape_attributes)
+            content_tag_string(name.to_s.dasherize, content || "", options, escape)
           end
         end
 
         def content_tag_string(name, content, options, escape = true)
           tag_options = tag_options(options, escape) if options
-          content     = ERB::Util.unwrapped_html_escape(content) if escape
+
+          if escape
+            name = ERB::Util.xml_name_escape(name)
+            content = ERB::Util.unwrapped_html_escape(content)
+          end
+
           "<#{name}#{tag_options}>#{PRE_CONTENT_STRINGS[name]}#{content}</#{name}>".html_safe
         end
 
@@ -85,6 +92,8 @@ module ActionView
         end
 
         def tag_option(key, value, escape)
+          key = ERB::Util.xml_name_escape(key) if escape
+
           if value.is_a?(Array)
             value = escape ? safe_join(value, " ") : value.join(" ")
           else
@@ -107,6 +116,27 @@ module ActionView
             true
           end
 
+          def handle_deprecated_escape_options(options)
+            # The option :escape_attributes has been merged into the options hash to be
+            # able to warn when it is used, so we need to handle default values here.
+            escape_option_provided = options.has_key?(:escape)
+            escape_attributes_option_provided = options.has_key?(:escape_attributes)
+
+            if escape_attributes_option_provided
+              ActiveSupport::Deprecation.warn(<<~MSG)
+                Use of the option :escape_attributes is deprecated. It currently \
+                escapes both names and values of tags and attributes and it is \
+                equivalent to :escape. If any of them are enabled, the escaping \
+                is fully enabled.
+              MSG
+            end
+
+            return true unless escape_option_provided || escape_attributes_option_provided
+            escape_option = options.delete(:escape)
+            escape_attributes_option = options.delete(:escape_attributes)
+            escape_option || escape_attributes_option
+          end
+
           def method_missing(called, *args, **options, &block)
             tag_string(called, *args, **options, &block)
           end
@@ -237,6 +267,7 @@ module ActionView
         if name.nil?
           tag_builder
         else
+          name = ERB::Util.xml_name_escape(name) if escape
           "<#{name}#{tag_builder.tag_options(options, escape) if options}#{open ? ">" : " />"}".html_safe
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 6.0.4.7
+  version: 6.0.5.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-08 00:00:00.000000000 Z
+date: 2022-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.4.7
+        version: 6.0.5.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -236,10 +236,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.4.7/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.4.7/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.5.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.5.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.4.7/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.5.1/actionview
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -256,7 +257,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.6
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).