activerecord 5.2.7.1 → 5.2.8.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of activerecord might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: e71404b8155dd3f920fddc311a695a697b91524bf1574537546e720d47285343
4
- data.tar.gz: 61995aa79883f273f01471f59eb748561b2ac443f250b20f717ebc4a6980f431
3
+ metadata.gz: 86737eb3187422c20dfc6d14b175ae9d541dfe670178da64a024c0968693ef81
4
+ data.tar.gz: 767900fd0d4a68dae1536cb7750e5456bc2bac72fde2ce7518ff69b1e5c8c706
5
5
  SHA512:
6
- metadata.gz: 5142128f1cfa2b5f8116c541eebef4d65d28fb351eb4cbb450aad153c5de43db43310e2a3bde61d79901c58f2834bd6a42f8dcead4d4893731fd917422e67a8c
7
- data.tar.gz: 662f5cc0a628cf54bc0de5d063fac8c21ca2d7e95f25b1c19b931934e1270c02a4b279447f1249ead3c35c2258b1258b52a0fb2a1e7097cc364d94c6737ad18e
6
+ metadata.gz: 0af8b7124c2d152f219220f518615b135137bb610d747b520d9c28370c73c966110121c3bede44a3ca0b9c36a4650f7ed300548e658eda7c888f7298b2f45162
7
+ data.tar.gz: 1a72afb896390c797673d4a100d7d9abd055a63fea21cef26e896a0cb424a64de661e99abb8cd80347643720d5c529dabe92af619dcaa7ff8610f4b3c1782483
data/CHANGELOG.md CHANGED
@@ -1,3 +1,36 @@
1
+ ## Rails 5.2.8.1 (July 12, 2022) ##
2
+
3
+ * Change ActiveRecord::Coders::YAMLColumn default to safe_load
4
+
5
+ This adds two new configuration options The configuration options are as
6
+ follows:
7
+
8
+ * `config.active_storage.use_yaml_unsafe_load`
9
+
10
+ When set to true, this configuration option tells Rails to use the old
11
+ "unsafe" YAML loading strategy, maintaining the existing behavior but leaving
12
+ the possible escalation vulnerability in place. Setting this option to true
13
+ is *not* recommended, but can aid in upgrading.
14
+
15
+ * `config.active_record.yaml_column_permitted_classes`
16
+
17
+ The "safe YAML" loading method does not allow all classes to be deserialized
18
+ by default. This option allows you to specify classes deemed "safe" in your
19
+ application. For example, if your application uses Symbol and Time in
20
+ serialized data, you can add Symbol and Time to the allowed list as follows:
21
+
22
+ ```
23
+ config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
24
+ ```
25
+
26
+ [CVE-2022-32224]
27
+
28
+
29
+ ## Rails 5.2.8 (May 09, 2022) ##
30
+
31
+ * No changes.
32
+
33
+
1
34
  ## Rails 5.2.7.1 (April 26, 2022) ##
2
35
 
3
36
  * No changes.
@@ -23,7 +23,7 @@ module ActiveRecord
23
23
  def load(yaml)
24
24
  return object_class.new if object_class != Object && yaml.nil?
25
25
  return yaml unless yaml.is_a?(String) && /^---/.match?(yaml)
26
- obj = YAML.load(yaml)
26
+ obj = yaml_load(yaml)
27
27
 
28
28
  assert_valid_value(obj, action: "load")
29
29
  obj ||= object_class.new if object_class != Object
@@ -45,6 +45,18 @@ module ActiveRecord
45
45
  rescue ArgumentError
46
46
  raise ArgumentError, "Cannot serialize #{object_class}. Classes passed to `serialize` must have a 0 argument constructor."
47
47
  end
48
+
49
+ def yaml_load(payload)
50
+ if !ActiveRecord::Base.use_yaml_unsafe_load
51
+ YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
52
+ else
53
+ if YAML.respond_to?(:unsafe_load)
54
+ YAML.unsafe_load(payload)
55
+ else
56
+ YAML.load(payload)
57
+ end
58
+ end
59
+ end
48
60
  end
49
61
  end
50
62
  end
@@ -125,6 +125,16 @@ module ActiveRecord
125
125
 
126
126
  mattr_accessor :belongs_to_required_by_default, instance_accessor: false
127
127
 
128
+ ##
129
+ # :singleton-method:
130
+ # Application configurable boolean that instructs the YAML Coder to use
131
+ # an unsafe load if set to true.
132
+ mattr_accessor :use_yaml_unsafe_load, instance_writer: false, default: false
133
+
134
+ # Application configurable array that provides additional permitted classes
135
+ # to Psych safe_load in the YAML Coder
136
+ mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: []
137
+
128
138
  class_attribute :default_connection_handler, instance_writer: false
129
139
 
130
140
  def self.connection_handler
@@ -9,7 +9,7 @@ module ActiveRecord
9
9
  module VERSION
10
10
  MAJOR = 5
11
11
  MINOR = 2
12
- TINY = 7
12
+ TINY = 8
13
13
  PRE = "1"
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
@@ -222,5 +222,23 @@ MSG
222
222
  end
223
223
  end
224
224
  end
225
+
226
+ initializer "active_record.use_yaml_unsafe_load" do |app|
227
+ config.after_initialize do
228
+ unless app.config.active_record.use_yaml_unsafe_load.nil?
229
+ ActiveRecord::Base.use_yaml_unsafe_load =
230
+ app.config.active_record.use_yaml_unsafe_load
231
+ end
232
+ end
233
+ end
234
+
235
+ initializer "active_record.yaml_column_permitted_classes" do |app|
236
+ config.after_initialize do
237
+ unless app.config.active_record.yaml_column_permitted_classes.nil?
238
+ ActiveRecord::Base.yaml_column_permitted_classes =
239
+ app.config.active_record.yaml_column_permitted_classes
240
+ end
241
+ end
242
+ end
225
243
  end
226
244
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: activerecord
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.2.7.1
4
+ version: 5.2.8.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-04-26 00:00:00.000000000 Z
11
+ date: 2022-07-12 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,28 +16,28 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 5.2.7.1
19
+ version: 5.2.8.1
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 5.2.7.1
26
+ version: 5.2.8.1
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: activemodel
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 5.2.7.1
33
+ version: 5.2.8.1
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 5.2.7.1
40
+ version: 5.2.8.1
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: arel
43
43
  requirement: !ruby/object:Gem::Requirement
@@ -307,8 +307,8 @@ homepage: http://rubyonrails.org
307
307
  licenses:
308
308
  - MIT
309
309
  metadata:
310
- source_code_uri: https://github.com/rails/rails/tree/v5.2.7.1/activerecord
311
- changelog_uri: https://github.com/rails/rails/blob/v5.2.7.1/activerecord/CHANGELOG.md
310
+ source_code_uri: https://github.com/rails/rails/tree/v5.2.8.1/activerecord
311
+ changelog_uri: https://github.com/rails/rails/blob/v5.2.8.1/activerecord/CHANGELOG.md
312
312
  post_install_message:
313
313
  rdoc_options:
314
314
  - "--main"
@@ -326,7 +326,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
326
326
  - !ruby/object:Gem::Version
327
327
  version: '0'
328
328
  requirements: []
329
- rubygems_version: 3.1.6
329
+ rubygems_version: 3.3.3
330
330
  signing_key:
331
331
  specification_version: 4
332
332
  summary: Object-relational mapper framework (part of Rails).