actionview 6.1.7.2 → 6.1.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af22af09202888663076683fcede2d6ff78cc16a5b53f046e9b14031dedd8832
-  data.tar.gz: 489ff31631f8e0a5e7f33814602ce9583489b5b89f2215a1d69558aa359807fa
+  metadata.gz: 978c1f3e62241eeb02e4613dbaa86317517fd540f0d6cd24a61725214e6a27d3
+  data.tar.gz: f97bb9a4191c7202164970cf2c0019dba3ee8b3173c57c0242419a3b32cd260c
 SHA512:
-  metadata.gz: 6c47f081dc4eea3b451febb506c4173cba87e81ef87519bd6b98311327a49627824f15f94e9da2f10f67f6115f0a12c985882897864dfce5b970bbe313ad1d8d
-  data.tar.gz: cf4dd94d64857da8e8b4a197fbe725645c268b9ac770bd9a354b0dfdcd2bfbf7a7a6d1bdffea735527fa8286e6a7ff00651cffb3374f6ebdba80598c1439c47e
+  metadata.gz: 8bf45fd0eee54a74b1a330d89331005cfb4891b4d41163de5a69fd092d57c040cd27f3ef8bd55efe73812198dff3ed867fcb5a2b8df6a78752061daf7436337a
+  data.tar.gz: 99f0b954470431b96da223d1d6878d7b50febadf6fcd13048bbf0ed44e0669a7be548d3c61adfd575e8b9c207bfb3763d533cb804eb0e54bebf5d97d9f855e25

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Rails 6.1.7.3 (March 13, 2023) ##
+
+*   Ignore certain data-* attributes in rails-ujs when element is contenteditable
+
+    [CVE-2023-23913]
+
+
 ## Rails 6.1.7.2 (January 24, 2023) ##
 
 *   No changes.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 6
     MINOR = 1
     TINY  = 7
-    PRE   = "2"
+    PRE   = "3"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/assets/compiled/rails-ujs.js

@@ -73,6 +73,22 @@ Released under the MIT license
         return element[expando][key] = value;
       };
 
+      Rails.isContentEditable = function(element) {
+        var isEditable;
+        isEditable = false;
+        while (true) {
+          if (element.isContentEditable) {
+            isEditable = true;
+            break;
+          }
+          element = element.parentElement;
+          if (!element) {
+            break;
+          }
+        }
+        return isEditable;
+      };
+
       Rails.$ = function(selector) {
         return Array.prototype.slice.call(document.querySelectorAll(selector));
       };
@@ -395,9 +411,9 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var disableFormElement, disableFormElements, disableLinkElement, enableFormElement, enableFormElements, enableLinkElement, formElements, getData, isXhrRedirect, matches, setData, stopEverything;
+      var disableFormElement, disableFormElements, disableLinkElement, enableFormElement, enableFormElements, enableLinkElement, formElements, getData, isContentEditable, isXhrRedirect, matches, setData, stopEverything;
 
-      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, stopEverything = Rails.stopEverything, formElements = Rails.formElements;
+      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, stopEverything = Rails.stopEverything, formElements = Rails.formElements, isContentEditable = Rails.isContentEditable;
 
       Rails.handleDisabledElement = function(e) {
         var element;
@@ -417,6 +433,9 @@ Released under the MIT license
         } else {
           element = e;
         }
+        if (isContentEditable(element)) {
+          return;
+        }
         if (matches(element, Rails.linkDisableSelector)) {
           return enableLinkElement(element);
         } else if (matches(element, Rails.buttonDisableSelector) || matches(element, Rails.formEnableSelector)) {
@@ -429,6 +448,9 @@ Released under the MIT license
       Rails.disableElement = function(e) {
         var element;
         element = e instanceof Event ? e.target : e;
+        if (isContentEditable(element)) {
+          return;
+        }
         if (matches(element, Rails.linkDisableSelector)) {
           return disableLinkElement(element);
         } else if (matches(element, Rails.buttonDisableSelector) || matches(element, Rails.formDisableSelector)) {
@@ -513,10 +535,12 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var stopEverything;
+      var isContentEditable, stopEverything;
 
       stopEverything = Rails.stopEverything;
 
+      isContentEditable = Rails.isContentEditable;
+
       Rails.handleMethod = function(e) {
         var csrfParam, csrfToken, form, formContent, href, link, method;
         link = this;
@@ -524,6 +548,9 @@ Released under the MIT license
         if (!method) {
           return;
         }
+        if (isContentEditable(this)) {
+          return;
+        }
         href = Rails.href(link);
         csrfToken = Rails.csrfToken();
         csrfParam = Rails.csrfParam();
@@ -545,10 +572,10 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var ajax, fire, getData, isCrossDomain, isRemote, matches, serializeElement, setData, stopEverything,
+      var ajax, fire, getData, isContentEditable, isCrossDomain, isRemote, matches, serializeElement, setData, stopEverything,
         slice = [].slice;
 
-      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, fire = Rails.fire, stopEverything = Rails.stopEverything, ajax = Rails.ajax, isCrossDomain = Rails.isCrossDomain, serializeElement = Rails.serializeElement;
+      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, fire = Rails.fire, stopEverything = Rails.stopEverything, ajax = Rails.ajax, isCrossDomain = Rails.isCrossDomain, serializeElement = Rails.serializeElement, isContentEditable = Rails.isContentEditable;
 
       isRemote = function(element) {
         var value;
@@ -566,6 +593,10 @@ Released under the MIT license
           fire(element, 'ajax:stopped');
           return false;
         }
+        if (isContentEditable(element)) {
+          fire(element, 'ajax:stopped');
+          return false;
+        }
         withCredentials = element.getAttribute('data-with-credentials');
         dataType = element.getAttribute('data-type') || 'script';
         if (matches(element, Rails.formSubmitSelector)) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 6.1.7.2
+  version: 6.1.7.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-25 00:00:00.000000000 Z
+date: 2023-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.2
+        version: 6.1.7.3
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -239,10 +239,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.2/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.7.2/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.3/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.3/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.2/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.3/actionview
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []