activerecord 6.0.3 → 6.0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8ac16c2194f2d74297c1fdbfd64c286003ce2aea666afd85bfa07ecac816877
-  data.tar.gz: a15e33a862b0985aea1d3b506ce53dd38678c3f47a121dddcd5c90388665788e
+  metadata.gz: 81509c096d5c718a2f031bb02276ffa200df9f23f6b95ca4ee001ff4b0ed3f0b
+  data.tar.gz: 171cbbd2a3dea6f8156b6662b47787ff29f0d538d24675321cd48875f7968faa
 SHA512:
-  metadata.gz: be693dc74628ffedf85fe5dd569b2bec88e1ccd1b3ed61a347ce63f612747c8e50485d41d46a70fd803f8fbc454572592e59bea246152c0902057ef5c384a235
-  data.tar.gz: 33294c99f5631c31762075cfb88da12fb106794f4a68d28d227fb177d92fe1afd832148331b9ba273f338fa749d1a3679cffaafef464549f79292e2de8b08e08
+  metadata.gz: b2c8ab3ddce74dcccaa27d4260db49ac55667e9a440c2187a0133ff211ec1305159ee3b74b71009ab59c5908d1d5d50b6be59191dd282d1e2dbf1198465556cc
+  data.tar.gz: f2d64203c46ec1cc691a0b46c3e3e84c602267596bd807f212ef43e285248a0e5051e30a2ae0c34fcd0528fa4856e0d509b3ac65f89b1600b8304aa7a7cb2ca8

data/CHANGELOG.md

@@ -1,3 +1,38 @@
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   Fix possible DoS vector in PostgreSQL money type
+
+    Carefully crafted input can cause a DoS via the regular expressions used
+    for validating the money format in the PostgreSQL adapter.  This patch
+    fixes the regexp.
+
+    Thanks to @dee-see from Hackerone for this patch!
+
+    [CVE-2021-22880]
+
+    *Aaron Patterson*
+
+
+## Rails 6.0.3.4 (October 07, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.3 (September 09, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.2 (June 17, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.1 (May 18, 2020) ##
+
+*   No changes.
+
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   Recommend applications don't use the `database` kwarg in `connected_to`

data/lib/active_record/connection_adapters/postgresql/oid/money.rb

@@ -26,9 +26,9 @@ module ActiveRecord
 
             value = value.sub(/^\((.+)\)$/, '-\1') # (4)
             case value
-            when /^-?\D*[\d,]+\.\d{2}$/  # (1)
+            when /^-?\D*+[\d,]+\.\d{2}$/  # (1)
               value.gsub!(/[^-\d.]/, "")
-            when /^-?\D*[\d.]+,\d{2}$/  # (2)
+            when /^-?\D*+[\d.]+,\d{2}$/  # (2)
               value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
             end
 

data/lib/active_record/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = nil
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.3
+  version: 6.0.3.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-06 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,10 +391,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.5/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.5/activerecord
 post_install_message: 
 rdoc_options:
 - "--main"
@@ -412,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).