activeadmin 3.1.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f41c15703a7796ce3b6395820049062ffd4f9fbfe7e95baeffadf283b1262d93
-  data.tar.gz: 6d78d624d8cf0fb7e8cc629b9d3145abf4a3180d2b1df206f4a765db5e2f66dd
+  metadata.gz: 500a0615ecf1635299471dcbc309082815a82d24f03528b7c5926c4a5449fb64
+  data.tar.gz: 7ee23a9a3f4658eef536dec2032b40a9d60b054272a09b5e5a833ee51fae4430
 SHA512:
-  metadata.gz: c530b7246911f1e83c9181795a969eafa11a83dc2ca7271e67d8944bb7d4a1391b5880c050bb77e6bb5535e44fc70460a53e42e838e6d694d2542f42efb37555
-  data.tar.gz: 8ca9cd7d704eb7c1eeda4b4210f6db07d8f9ce72caacdd8bc46ae9b188fe518316d8a2714350986960492b6aafc56dd9462ab2ac3272b25361b7e8777034525f
+  metadata.gz: 62b6e4f0a45f0d1d102dd3753de0fdddd4b661e6f53af9caebf37fcdda1924e769ed932027f517147f0db2e0c9724bcff49ca5640130a524ae48701c3ae1551b
+  data.tar.gz: eb0a26b263ed3cb17e8157581ac30a182467649b622807a4af9fccc2618ddb6b392307e4ec16abca591ed6f3b039c451868c7d9a6869ea89de68893672962455

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+## 3.2.0 [☰](https://github.com/activeadmin/activeadmin/compare/v3.1.0..v3.2.0)
+
+### Security Fixes
+
+* Backport protect against CSV Injection. [#8167] by [@mgrunberg]
+
+### Enhancements
+
+* Backport support citext column type in string filter. [#8165] by [@mgrunberg]
+* Backport provide detail in DB statement timeout error for filters. [#8163] by [@mgrunberg]
+
+### Bug Fixes
+
+* Backport make sure menu creation does not modify menu options. [#8166] by [@mgrunberg]
+* Backport ransack error with filters when ActiveStorage is used. [#8164] by [@mgrunberg]
+
 ## 3.1.0 [☰](https://github.com/activeadmin/activeadmin/compare/v3.0.0..v3.1.0)
 
 ### Enhancements
@@ -877,6 +893,11 @@ Please check [0-6-stable] for previous changes.
 [#8102]: https://github.com/activeadmin/activeadmin/pull/8102
 [#8105]: https://github.com/activeadmin/activeadmin/pull/8105
 [#8106]: https://github.com/activeadmin/activeadmin/pull/8106
+[#8163]: https://github.com/activeadmin/activeadmin/pull/8163
+[#8164]: https://github.com/activeadmin/activeadmin/pull/8164
+[#8165]: https://github.com/activeadmin/activeadmin/pull/8165
+[#8166]: https://github.com/activeadmin/activeadmin/pull/8166
+[#8167]: https://github.com/activeadmin/activeadmin/pull/8167
 
 [@1000ship]: https://github.com/1000ship
 [@5t111111]: https://github.com/5t111111

data/lib/active_admin/csv_builder.rb

@@ -51,7 +51,7 @@ module ActiveAdmin
       csv << bom if bom
 
       if column_names
-        csv << CSV.generate_line(columns.map { |c| encode c.name, options }, **csv_options)
+        csv << CSV.generate_line(columns.map { |c| sanitize(encode(c.name, options)) }, **csv_options)
       end
 
       controller.send(:in_paginated_batches) do |resource|
@@ -70,7 +70,7 @@ module ActiveAdmin
 
     def build_row(resource, columns, options)
       columns.map do |column|
-        encode call_method_or_proc_on(resource, column.data), options
+        sanitize(encode(call_method_or_proc_on(resource, column.data), options))
       end
     end
 
@@ -86,6 +86,10 @@ module ActiveAdmin
       end
     end
 
+    def sanitize(content)
+      Sanitizer.sanitize(content)
+    end
+
     def method_missing(method, *args, &block)
       if @view_context.respond_to? method
         @view_context.public_send method, *args, &block
@@ -120,4 +124,21 @@ module ActiveAdmin
       @column_transitive_options ||= @options.slice(*COLUMN_TRANSITIVE_OPTIONS)
     end
   end
+
+  # Prevents CSV Injection according to https://owasp.org/www-community/attacks/CSV_Injection
+  module Sanitizer
+    extend self
+
+    ATTACK_CHARACTERS = ["=", "+", "-", "@", "\t", "\r"].freeze
+
+    def sanitize(value)
+      return "'#{value}" if require_sanitization?(value)
+
+      value
+    end
+
+    def require_sanitization?(value)
+      value.is_a?(String) && value.starts_with?(*ATTACK_CHARACTERS)
+    end
+  end
 end

data/lib/active_admin/filters/forms.rb

@@ -31,7 +31,7 @@ module ActiveAdmin
           case column.type
           when :date, :datetime
             :date_range
-          when :string, :text
+          when :string, :text, :citext
             :string
           when :integer, :float, :decimal
             :numeric

data/lib/active_admin/filters/formtastic_addons.rb

@@ -47,7 +47,7 @@ module ActiveAdmin
       #
 
       def searchable_has_many_through?
-        if reflection && reflection.options[:through]
+        if klass.ransackable_associations.include?(method.to_s) && reflection && reflection.options[:through]
           reflection.through_reflection.klass.ransackable_attributes.include? reflection.foreign_key
         else
           false

data/lib/active_admin/inputs/filters/select_input.rb

@@ -43,6 +43,8 @@ module ActiveAdmin
           else
             super
           end
+        rescue ActiveRecord::QueryCanceled => error
+          raise ActiveRecord::QueryCanceled.new "#{error.message.strip} while querying the values for the ActiveAdmin :#{method} filter"
         end
 
         def pluck_column

data/lib/active_admin/menu.rb

@@ -48,6 +48,7 @@ module ActiveAdmin
       #   menu.add parent: 'Dashboard', label: 'My Child Dashboard'
       #
       def add(options)
+        options = options.dup # Make sure parameter is not modified
         parent_chain = Array.wrap(options.delete(:parent))
 
         item = if parent = parent_chain.shift

data/lib/active_admin/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module ActiveAdmin
-  VERSION = "3.1.0"
+  VERSION = "3.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Charles Maresh
@@ -15,7 +15,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-10-23 00:00:00.000000000 Z
+date: 2023-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: arbre
@@ -520,7 +520,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.13
+rubygems_version: 3.4.21
 signing_key:
 specification_version: 4
 summary: Active Admin is a Ruby on Rails plugin for generating administration style