activerecord 6.0.3.4 → 6.0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 140f6f368f1117ee61cd524faca9684ae30de2683f916da86fc5d407a7745cca
-  data.tar.gz: e4c73cf6172c0d17caaf5f4d705e4a4ebff642d0db70c3a70b67f98b8f60b5c4
+  metadata.gz: 81509c096d5c718a2f031bb02276ffa200df9f23f6b95ca4ee001ff4b0ed3f0b
+  data.tar.gz: 171cbbd2a3dea6f8156b6662b47787ff29f0d538d24675321cd48875f7968faa
 SHA512:
-  metadata.gz: ef0ee3b5b549012bf375144e37e33ca1061dfdd6c2b2a95b4dddf97e42260f7127b64f2d34cf48ac6a532a33b84bff16db6a5bc7263f18773db71a347c13ea01
-  data.tar.gz: 4fc23dcaa4cd671863cf194f6d8ab9673353e4b78f647224b25a76b00d947cc740f00a89c78ecd55384c9d3146f183f5bd1d756ec3e99c5794047ab068d05d8b
+  metadata.gz: b2c8ab3ddce74dcccaa27d4260db49ac55667e9a440c2187a0133ff211ec1305159ee3b74b71009ab59c5908d1d5d50b6be59191dd282d1e2dbf1198465556cc
+  data.tar.gz: f2d64203c46ec1cc691a0b46c3e3e84c602267596bd807f212ef43e285248a0e5051e30a2ae0c34fcd0528fa4856e0d509b3ac65f89b1600b8304aa7a7cb2ca8

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   Fix possible DoS vector in PostgreSQL money type
+
+    Carefully crafted input can cause a DoS via the regular expressions used
+    for validating the money format in the PostgreSQL adapter.  This patch
+    fixes the regexp.
+
+    Thanks to @dee-see from Hackerone for this patch!
+
+    [CVE-2021-22880]
+
+    *Aaron Patterson*
+
+
 ## Rails 6.0.3.4 (October 07, 2020) ##
 
 *   No changes.

data/lib/active_record/connection_adapters/postgresql/oid/money.rb

@@ -26,9 +26,9 @@ module ActiveRecord
 
             value = value.sub(/^\((.+)\)$/, '-\1') # (4)
             case value
-            when /^-?\D*[\d,]+\.\d{2}$/  # (1)
+            when /^-?\D*+[\d,]+\.\d{2}$/  # (1)
               value.gsub!(/[^-\d.]/, "")
-            when /^-?\D*[\d.]+,\d{2}$/  # (2)
+            when /^-?\D*+[\d.]+,\d{2}$/  # (2)
               value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
             end
 

data/lib/active_record/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = "4"
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.3.4
+  version: 6.0.3.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-07 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.5
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,11 +391,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.4/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3.4/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.5/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.4/activerecord
-post_install_message:
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.5/activerecord
+post_install_message: 
 rdoc_options:
 - "--main"
 - README.rdoc
@@ -412,8 +412,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.0.3
+signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).
 test_files: []