activerecord 6.0.5 → 6.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b924984d698eccbd8d5220f19aea7ec6adc25ebffd166df8952a4725ecf6e92
-  data.tar.gz: dcd92d322eb2ea79de53237472aad6ce7bba4d49004bb7efbd4b5745e69687d7
+  metadata.gz: c6ce12f937513b9efe3578fdbe01cdeee38dbb3d16d38058099f2ab1e1c7e71a
+  data.tar.gz: ec06c07afcbdd62043bce7bb57c0e3fca32658404088b706a2b4188e919e5bf7
 SHA512:
-  metadata.gz: 3809f3a8db911d86b1a3f650e3b851907c692207e281ee03221817c08ef54b3a963855d95727a876db78687caa1da6f2b90d6c917d0006e862711d04e8b89164
-  data.tar.gz: 6cca66d11a39d09266d8376efec65a0b13b0f4afe68363dc0d12a52b6b6c745d8dbd2f011085f73fc6344c8e604626560f24a1a9484c06deae4a044fac39afc3
+  metadata.gz: d77444fd1cafdcf149d0e64da878e9f756b5a836720fa49145f93520168ed709c52e6e03d7081c2a7916b11cd3f9a4973859257b3f02765c9e504253dbb85783
+  data.tar.gz: 1ef9d00fc16e11d028a464e437f285a3f3d4300295c6d947ef0c9b0e51f377f2015e60166ae4c0ef719f8593f3af151c275cc1377e982405df9dd978736c43cd

data/CHANGELOG.md

@@ -1,3 +1,38 @@
+## Rails 6.0.6 (September 09, 2022) ##
+
+*   Symbol is allowed by default for YAML columns
+
+    *Étienne Barrié*
+
+
+## Rails 6.0.5.1 (July 12, 2022) ##
+
+*   Change ActiveRecord::Coders::YAMLColumn default to safe_load
+
+    This adds two new configuration options The configuration options are as
+    follows:
+    
+    * `config.active_storage.use_yaml_unsafe_load`
+    
+    When set to true, this configuration option tells Rails to use the old
+    "unsafe" YAML loading strategy, maintaining the existing behavior but leaving
+    the possible escalation vulnerability in place.  Setting this option to true
+    is *not* recommended, but can aid in upgrading.
+    
+    * `config.active_record.yaml_column_permitted_classes`
+    
+    The "safe YAML" loading method does not allow all classes to be deserialized
+    by default.  This option allows you to specify classes deemed "safe" in your
+    application.  For example, if your application uses Symbol and Time in
+    serialized data, you can add Symbol and Time to the allowed list as follows:
+    
+    ```
+    config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
+    ```
+
+    [CVE-2022-32224]
+
+
 ## Rails 6.0.5 (May 09, 2022) ##
 
 *   No changes.

data/lib/active_record/coders/yaml_column.rb

@@ -23,7 +23,7 @@ module ActiveRecord
       def load(yaml)
         return object_class.new if object_class != Object && yaml.nil?
         return yaml unless yaml.is_a?(String) && /^---/.match?(yaml)
-        obj = YAML.load(yaml)
+        obj = yaml_load(yaml)
 
         assert_valid_value(obj, action: "load")
         obj ||= object_class.new if object_class != Object
@@ -44,6 +44,28 @@ module ActiveRecord
         rescue ArgumentError
           raise ArgumentError, "Cannot serialize #{object_class}. Classes passed to `serialize` must have a 0 argument constructor."
         end
+
+        if YAML.respond_to?(:unsafe_load)
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
+              YAML.unsafe_load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
+          end
+        else
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
+              YAML.load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
+          end
+        end
     end
   end
 end

data/lib/active_record/core.rb

@@ -128,6 +128,16 @@ module ActiveRecord
 
       mattr_accessor :reading_role, instance_accessor: false, default: :reading
 
+      ##
+      # :singleton-method:
+      # Application configurable boolean that instructs the YAML Coder to use
+      # an unsafe load if set to true.
+      mattr_accessor :use_yaml_unsafe_load, instance_writer: false, default: false
+
+      # Application configurable array that provides additional permitted classes
+      # to Psych safe_load in the YAML Coder
+      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: [Symbol]
+
       class_attribute :default_connection_handler, instance_writer: false
 
       self.filter_attributes = []

data/lib/active_record/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveRecord
   module VERSION
     MAJOR = 6
     MINOR = 0
-    TINY  = 5
+    TINY  = 6
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.5
+  version: 6.0.6
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5
+        version: 6.0.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5
+        version: 6.0.6
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5
+        version: 6.0.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.5
+        version: 6.0.6
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,10 +391,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.5/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.5/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.6/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.6/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.5/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.6/activerecord
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options:
@@ -413,7 +413,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).