activerecord 6.0.5.1 → 6.0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ea0b87ad16a3ed676492be593b8278b33ef3399e6c439763805809bd3fb04e1
-  data.tar.gz: bf40b7a7aa6cbfb55455b3731ffad825e9091b43c7e3e616a4c4c6b106b8008f
+  metadata.gz: 62b3dcd186d829531c34dec576e3fd66b4cccb2406fe1e0f8acad98a98e60ba6
+  data.tar.gz: 36d39bff0326c50ab47c2f2b36626bce5d670a38c8e6a01a50176ff9f04f74b0
 SHA512:
-  metadata.gz: 43e01975ab59ba04e4a3530ad8b4201655ce0cad7b282ffeb95c58e9304e97c41290bc517f96080c2a832d87ad6edd310c1f625597c7aec28d5291ec47f90c22
-  data.tar.gz: f042ff5e68d069a577f8b3233c05bc03e453429cf7f7d89be189a65ce22825117d36f4c94cf5526e5aeebe036cc624fe2cbf09e89bc9a64e766f9f27fa8f68fe
+  metadata.gz: 9c6294d1f7ac84e1c763ba79d91877f64af76daad98a44c820690d4b325efa87a6de87e257c2a9491a5ffcd0b0ce0e4f9ac453df28bdb11b389c4005e73e9139
+  data.tar.gz: b0977e39fb7156f7d3cb9940da3036987fc37d7d813d2c17ec465097dab254231236f5c2fb4854991320a0b6bd624ce860faf2db42dfc45fed20dfb743f0b038

data/CHANGELOG.md

@@ -1,3 +1,29 @@
+## Rails 6.0.6.1 (January 17, 2023) ##
+
+*   Make `sanitize_as_sql_comment` more strict
+
+    Though this method was likely never meant to take user input, it was
+    attempting sanitization. That sanitization could be bypassed with
+    carefully crafted input.
+
+    This commit makes the sanitization more robust by replacing any
+    occurrances of "/*" or "*/" with "/ *" or "* /". It also performs a
+    first pass to remove one surrounding comment to avoid compatibility
+    issues for users relying on the existing removal.
+
+    This also clarifies in the documentation of annotate that it should not
+    be provided user input.
+
+    [CVE-2023-22794]
+
+
+## Rails 6.0.6 (September 09, 2022) ##
+
+*   Symbol is allowed by default for YAML columns
+
+    *Étienne Barrié*
+
+
 ## Rails 6.0.5.1 (July 12, 2022) ##
 
 *   Change ActiveRecord::Coders::YAMLColumn default to safe_load

data/lib/active_record/coders/yaml_column.rb

@@ -45,14 +45,24 @@ module ActiveRecord
           raise ArgumentError, "Cannot serialize #{object_class}. Classes passed to `serialize` must have a 0 argument constructor."
         end
 
-        def yaml_load(payload)
-          if !ActiveRecord::Base.use_yaml_unsafe_load
-            YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
-          else
-            if YAML.respond_to?(:unsafe_load)
+        if YAML.respond_to?(:unsafe_load)
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
               YAML.unsafe_load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
             else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
+          end
+        else
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
               YAML.load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
             end
           end
         end

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -139,7 +139,16 @@ module ActiveRecord
       end
 
       def sanitize_as_sql_comment(value) # :nodoc:
-        value.to_s.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+        # Sanitize a string to appear within a SQL comment
+        # For compatibility, this also surrounding "/*+", "/*", and "*/"
+        # charcacters, possibly with single surrounding space.
+        # Then follows that by replacing any internal "*/" or "/ *" with
+        # "* /" or "/ *"
+        comment = value.to_s.dup
+        comment.gsub!(%r{\A\s*/\*\+?\s?|\s?\*/\s*\Z}, "")
+        comment.gsub!("*/", "* /")
+        comment.gsub!("/*", "/ *")
+        comment
       end
 
       def column_name_matcher # :nodoc:

data/lib/active_record/core.rb

@@ -136,7 +136,7 @@ module ActiveRecord
 
       # Application configurable array that provides additional permitted classes
       # to Psych safe_load in the YAML Coder
-      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: []
+      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: [Symbol]
 
       class_attribute :default_connection_handler, instance_writer: false
 

data/lib/active_record/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveRecord
   module VERSION
     MAJOR = 6
     MINOR = 0
-    TINY  = 5
+    TINY  = 6
     PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/active_record/railtie.rb

@@ -259,23 +259,5 @@ To keep using the current cache store, you can turn off cache versioning entirel
         self.filter_attributes += Rails.application.config.filter_parameters
       end
     end
-
-    initializer "active_record.use_yaml_unsafe_load" do |app|
-      config.after_initialize do
-        unless app.config.active_record.use_yaml_unsafe_load.nil?
-          ActiveRecord::Base.use_yaml_unsafe_load =
-            app.config.active_record.use_yaml_unsafe_load
-        end
-      end
-    end
-
-    initializer "active_record.yaml_column_permitted_classes" do |app|
-      config.after_initialize do
-        unless app.config.active_record.yaml_column_permitted_classes.nil?
-          ActiveRecord::Base.yaml_column_permitted_classes =
-            app.config.active_record.yaml_column_permitted_classes
-        end
-      end
-    end
   end
 end

data/lib/active_record/relation/query_methods.rb

@@ -1000,6 +1000,8 @@ module ActiveRecord
     #   # SELECT "users"."name" FROM "users" /* selecting */ /* user */ /* names */
     #
     # The SQL block comment delimiters, "/*" and "*/", will be added automatically.
+    #
+    # Some escaping is performed, however untrusted user input should not be used.
     def annotate(*args)
       check_if_method_has_arguments!(:annotate, args)
       spawn.annotate!(*args)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.5.1
+  version: 6.0.6.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-07-12 00:00:00.000000000 Z
+date: 2023-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5.1
+        version: 6.0.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5.1
+        version: 6.0.6.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5.1
+        version: 6.0.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5.1
+        version: 6.0.6.1
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,10 +391,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.5.1/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.5.1/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.6.1/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.6.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.5.1/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.6.1/activerecord
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options:
@@ -413,7 +413,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.4.3
 signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).