activerecord 6.0.3.4 → 6.0.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 140f6f368f1117ee61cd524faca9684ae30de2683f916da86fc5d407a7745cca
-  data.tar.gz: e4c73cf6172c0d17caaf5f4d705e4a4ebff642d0db70c3a70b67f98b8f60b5c4
+  metadata.gz: 10483d65f664af6e16b8846c4e732c1684ccce361c7f5de71174d4c58667d7f0
+  data.tar.gz: b8e115b38be1bb8a9cfd2b405d5be96c21c7a1b402e63280ad1cef7d495e0cd9
 SHA512:
-  metadata.gz: ef0ee3b5b549012bf375144e37e33ca1061dfdd6c2b2a95b4dddf97e42260f7127b64f2d34cf48ac6a532a33b84bff16db6a5bc7263f18773db71a347c13ea01
-  data.tar.gz: 4fc23dcaa4cd671863cf194f6d8ab9673353e4b78f647224b25a76b00d947cc740f00a89c78ecd55384c9d3146f183f5bd1d756ec3e99c5794047ab068d05d8b
+  metadata.gz: 870e5ab273716a3b06ab68e5b18bf107cb8dfbba027df6c4c021628b7a5384c38b44d60a97df83da109aca4df075394ae88e8f8f76a61a63182fa2055b51a012
+  data.tar.gz: 1371263b37deb82f2f8af79399c9bfa955bfc819930779136de843caf0266cb3da913b2b8709c0fbf841478ef663fe9a7d8e1f6025909c7d630ab9e7b337fb00

data/CHANGELOG.md

@@ -1,3 +1,23 @@
+## Rails 6.0.3.6 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   Fix possible DoS vector in PostgreSQL money type
+
+    Carefully crafted input can cause a DoS via the regular expressions used
+    for validating the money format in the PostgreSQL adapter.  This patch
+    fixes the regexp.
+
+    Thanks to @dee-see from Hackerone for this patch!
+
+    [CVE-2021-22880]
+
+    *Aaron Patterson*
+
+
 ## Rails 6.0.3.4 (October 07, 2020) ##
 
 *   No changes.

data/lib/active_record/connection_adapters/postgresql/oid/money.rb

@@ -26,9 +26,9 @@ module ActiveRecord
 
             value = value.sub(/^\((.+)\)$/, '-\1') # (4)
             case value
-            when /^-?\D*[\d,]+\.\d{2}$/  # (1)
+            when /^-?\D*+[\d,]+\.\d{2}$/  # (1)
               value.gsub!(/[^-\d.]/, "")
-            when /^-?\D*[\d.]+,\d{2}$/  # (2)
+            when /^-?\D*+[\d.]+,\d{2}$/  # (2)
               value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
             end
 

data/lib/active_record/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = "4"
+    PRE   = "6"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.3.4
+  version: 6.0.3.6
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-07 00:00:00.000000000 Z
+date: 2021-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.6
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: 6.0.3.6
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,11 +391,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.4/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3.4/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.6/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.6/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.4/activerecord
-post_install_message:
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.6/activerecord
+post_install_message: 
 rdoc_options:
 - "--main"
 - README.rdoc
@@ -412,8 +412,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.1.2
+signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).
 test_files: []