activesupport 3.2.15 → 3.2.22.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 636193f4141de35df8d61b98d26230c67f46c94a
-  data.tar.gz: 91fb48ab66b85564d54e567f188b9aa08e9c63cb
+  metadata.gz: 4b15bde7001a62e9472c83fc6f8e6db88beb52ec
+  data.tar.gz: 303f5296b0c7e8aecd64a8113f3facc515a5415a
 SHA512:
-  metadata.gz: ab6b28970b7f8891c2420b335a3100ae2809c7058fbe0a96a05708197b7a0aff4477f340f27d580f3f5a6cde599463b63b931ba50ad17f9497ca372a157416b9
-  data.tar.gz: 108c6bc3539cb237131030b3eb6f4e99e7c14e49f8a15a38bbf72f5e724c2cd861acf740c28827ec911e7bce67ca9b72d94d356db684f888b8d49e79e6b38020
+  metadata.gz: b31859710c9973c587e6eae0a1156360f7a4d4a1f34b120de08672f93c5bb87222a3d97ecaeb3fa6a3c195713a17018244d2979834fcbaecf44e6b530ca37cbf
+  data.tar.gz: af7fbe3a0fc5916afcacabfb17e3390483641773af5f1b38e917e0d009f74761f4e3a94bc0c83f68b9022532f609c7c18c475e6b227ce18e7653643764011e15

data/CHANGELOG.md

@@ -1,3 +1,37 @@
+## Rails 3.2.22 (Jun 16, 2015) ##
+
+*   Fix denial of service vulnerability in the XML processing.
+
+    CVE-2015-3227.
+
+    *Aaron Patterson*
+
+
+## Rails 3.2.19 (Jul 2, 2014) ##
+
+*   Make sure Active Support configurations are applied correctly.
+
+    Before this change configuration set using `config.active_support`
+    would not be set.
+
+    *Rafael Mendonça França*
+
+
+## Rails 3.2.18 (May 6, 2014) ##
+
+* No changes.
+
+
+## Rails 3.2.17 (Feb 18, 2014) ##
+
+* No changes.
+
+
+## Rails 3.2.16 (Dec 3, 2013) ##
+
+* No changes.
+
+
 ## Rails 3.2.15 (Oct 16, 2013) ##
 
 *   Fix ActiveSupport::Cache::FileStore#cleanup to no longer rely on missing each_key method.

data/lib/active_support/core_ext/big_decimal/conversions.rb

@@ -16,7 +16,9 @@ class BigDecimal
   #
   # Note that reconstituting YAML floats to native floats may lose precision.
   def to_yaml(opts = {})
-    return super if defined?(YAML::ENGINE) && !YAML::ENGINE.syck?
+    return super if
+      (defined?(YAML::ENGINE) && !YAML::ENGINE.syck?) ||
+      (defined?(Psych) && YAML == Psych)
 
     YAML.quick_emit(nil, opts) do |out|
       string = to_s

data/lib/active_support/core_ext/class/attribute.rb

@@ -109,7 +109,9 @@ class Class
   end
 
   private
-  def singleton_class?
-    ancestors.first != self
-  end
+    unless respond_to?(:singleton_class?)
+      def singleton_class?
+        ancestors.first != self
+      end
+    end
 end

data/lib/active_support/core_ext/date_time/calculations.rb

@@ -138,6 +138,12 @@ class DateTime
 
   # Layers additional behavior on DateTime#<=> so that Time and ActiveSupport::TimeWithZone instances can be compared with a DateTime
   def <=>(other)
-    super other.kind_of?(Infinity) ? other : other.to_datetime
+    if other.kind_of?(Infinity)
+      super
+    elsif other.respond_to? :to_datetime
+      super other.to_datetime
+    else
+      nil
+    end
   end
 end

data/lib/active_support/railtie.rb

@@ -55,5 +55,12 @@ module ActiveSupport
 
       Time.zone_default = zone_default
     end
+
+    initializer "active_support.set_configs" do |app|
+      app.config.active_support.each do |k, v|
+        k = "#{k}="
+        ActiveSupport.send(k, v) if ActiveSupport.respond_to? k
+      end
+    end
   end
 end

data/lib/active_support/security_utils.rb

@@ -0,0 +1,27 @@
+require 'digest'
+
+module ActiveSupport
+  module SecurityUtils
+    # Constant time string comparison.
+    #
+    # The values compared should be of fixed length, such as strings
+    # that have already been processed by HMAC. This should not be used
+    # on variable length plaintext strings because it could leak length info
+    # via timing attacks.
+    def secure_compare(a, b)
+      return false unless a.bytesize == b.bytesize
+
+      l = a.unpack "C#{a.bytesize}"
+
+      res = 0
+      b.each_byte { |byte| res |= byte ^ l.shift }
+      res == 0
+    end
+    module_function :secure_compare
+
+    def variable_size_secure_compare(a, b) # :nodoc:
+      secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
+    end
+    module_function :variable_size_secure_compare
+  end
+end

data/lib/active_support/test_case.rb

@@ -1,4 +1,8 @@
-require 'test/unit/testcase'
+begin
+  require 'test/unit/testcase'
+rescue LoadError => e
+  raise LoadError, "Please add test-unit gem to your Gemfile: `gem 'test-unit', '~> 3.0'` (#{e.message})", e.backtrace
+end
 require 'active_support/testing/setup_and_teardown'
 require 'active_support/testing/assertions'
 require 'active_support/testing/deprecation'

data/lib/active_support/testing/isolation.rb

@@ -156,7 +156,12 @@ end
 
 # Only in subprocess for windows / jruby.
 if ENV['ISOLATION_TEST']
-  require "test/unit/collector/objectspace"
+  begin
+    require "test/unit/collector/objectspace"
+  rescue LoadError => e
+    raise LoadError, "Please add test-unit gem to your Gemfile: `gem 'test-unit', '~> 3.0'` (#{e.message})", e.backtrace
+  end
+
   class Test::Unit::Collector::ObjectSpace
     def include?(test)
       super && test.method_name == ENV['ISOLATION_TEST']

data/lib/active_support/values/time_zone.rb

@@ -223,6 +223,7 @@ module ActiveSupport
     # Compare this time zone to the parameter. The two are compared first on
     # their offsets, and then by name.
     def <=>(zone)
+      return unless zone.respond_to?(:utc_offset) && zone.respond_to?(:name)
       result = (utc_offset <=> zone.utc_offset)
       result = (name <=> zone.name) if result == 0
       result
@@ -267,7 +268,7 @@ module ActiveSupport
     #
     #   Time.zone.now                 # => Fri, 31 Dec 1999 14:00:00 HST -10:00
     #   Time.zone.parse('22:30:00')   # => Fri, 31 Dec 1999 22:30:00 HST -10:00
-    def parse(str, now=now)
+    def parse(str, now=self.now)
       parts = Date._parse(str, false)
       return if parts.empty?
 

data/lib/active_support/version.rb

@@ -2,8 +2,8 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 15
-    PRE   = nil
+    TINY  = 22
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
   end

data/lib/active_support/xml_mini.rb

@@ -77,6 +77,9 @@ module ActiveSupport
     end
 
     attr_reader :backend
+    attr_accessor :depth
+    self.depth = 100
+
     delegate :parse, :to => :backend
 
     def backend=(name)

data/lib/active_support/xml_mini/jdom.rb

@@ -47,7 +47,7 @@ module ActiveSupport
         xml_string_reader = StringReader.new(data)
         xml_input_source = InputSource.new(xml_string_reader)
         doc = @dbf.new_document_builder.parse(xml_input_source)
-        merge_element!({CONTENT_KEY => ''}, doc.document_element)
+        merge_element!({CONTENT_KEY => ''}, doc.document_element, XmlMini.depth)
       end
     end
 
@@ -59,9 +59,10 @@ module ActiveSupport
     #   Hash to merge the converted element into.
     # element::
     #   XML element to merge into hash
-    def merge_element!(hash, element)
+    def merge_element!(hash, element, depth)
+      raise 'Document too deep!' if depth == 0
       delete_empty(hash)
-      merge!(hash, element.tag_name, collapse(element))
+      merge!(hash, element.tag_name, collapse(element, depth))
     end
 
     def delete_empty(hash)
@@ -72,14 +73,14 @@ module ActiveSupport
     #
     # element::
     #   The document element to be collapsed.
-    def collapse(element)
+    def collapse(element, depth)
       hash = get_attributes(element)
 
       child_nodes = element.child_nodes
       if child_nodes.length > 0
         for i in 0...child_nodes.length
           child = child_nodes.item(i)
-          merge_element!(hash, child) unless child.node_type == Node.TEXT_NODE
+          merge_element!(hash, child, depth - 1) unless child.node_type == Node.TEXT_NODE
         end
         merge_texts!(hash, element) unless empty_content?(element)
         hash

data/lib/active_support/xml_mini/rexml.rb

@@ -30,7 +30,7 @@ module ActiveSupport
         doc = REXML::Document.new(data)
 
         if doc.root
-          merge_element!({}, doc.root)
+          merge_element!({}, doc.root, XmlMini.depth)
         else
           raise REXML::ParseException,
             "The document #{doc.to_s.inspect} does not have a valid root"
@@ -45,19 +45,20 @@ module ActiveSupport
       #   Hash to merge the converted element into.
       # element::
       #   XML element to merge into hash
-      def merge_element!(hash, element)
-        merge!(hash, element.name, collapse(element))
+      def merge_element!(hash, element, depth)
+        raise REXML::ParseException, "The document is too deep" if depth == 0
+        merge!(hash, element.name, collapse(element, depth))
       end
 
       # Actually converts an XML document element into a data structure.
       #
       # element::
       #   The document element to be collapsed.
-      def collapse(element)
+      def collapse(element, depth)
         hash = get_attributes(element)
 
         if element.has_elements?
-          element.each_element {|child| merge_element!(hash, child) }
+          element.each_element {|child| merge_element!(hash, child, depth - 1) }
           merge_texts!(hash, element) unless empty_content?(element)
           hash
         else

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 3.2.15
+  version: 3.2.22.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-16 00:00:00.000000000 Z
+date: 2016-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -55,6 +55,7 @@ files:
 - CHANGELOG.md
 - MIT-LICENSE
 - README.rdoc
+- lib/active_support.rb
 - lib/active_support/all.rb
 - lib/active_support/backtrace_cleaner.rb
 - lib/active_support/base64.rb
@@ -62,15 +63,17 @@ files:
 - lib/active_support/benchmarkable.rb
 - lib/active_support/buffered_logger.rb
 - lib/active_support/builder.rb
+- lib/active_support/cache.rb
 - lib/active_support/cache/file_store.rb
 - lib/active_support/cache/mem_cache_store.rb
 - lib/active_support/cache/memory_store.rb
 - lib/active_support/cache/null_store.rb
 - lib/active_support/cache/strategy/local_cache.rb
-- lib/active_support/cache.rb
 - lib/active_support/callbacks.rb
 - lib/active_support/concern.rb
 - lib/active_support/configurable.rb
+- lib/active_support/core_ext.rb
+- lib/active_support/core_ext/array.rb
 - lib/active_support/core_ext/array/access.rb
 - lib/active_support/core_ext/array/conversions.rb
 - lib/active_support/core_ext/array/extract_options.rb
@@ -79,15 +82,14 @@ files:
 - lib/active_support/core_ext/array/random_access.rb
 - lib/active_support/core_ext/array/uniq_by.rb
 - lib/active_support/core_ext/array/wrap.rb
-- lib/active_support/core_ext/array.rb
 - lib/active_support/core_ext/benchmark.rb
-- lib/active_support/core_ext/big_decimal/conversions.rb
 - lib/active_support/core_ext/big_decimal.rb
+- lib/active_support/core_ext/big_decimal/conversions.rb
+- lib/active_support/core_ext/class.rb
 - lib/active_support/core_ext/class/attribute.rb
 - lib/active_support/core_ext/class/attribute_accessors.rb
 - lib/active_support/core_ext/class/delegating_attributes.rb
 - lib/active_support/core_ext/class/subclasses.rb
-- lib/active_support/core_ext/class.rb
 - lib/active_support/core_ext/date/acts_like.rb
 - lib/active_support/core_ext/date/calculations.rb
 - lib/active_support/core_ext/date/conversions.rb
@@ -99,11 +101,12 @@ files:
 - lib/active_support/core_ext/date_time/zones.rb
 - lib/active_support/core_ext/enumerable.rb
 - lib/active_support/core_ext/exception.rb
+- lib/active_support/core_ext/file.rb
 - lib/active_support/core_ext/file/atomic.rb
 - lib/active_support/core_ext/file/path.rb
-- lib/active_support/core_ext/file.rb
-- lib/active_support/core_ext/float/rounding.rb
 - lib/active_support/core_ext/float.rb
+- lib/active_support/core_ext/float/rounding.rb
+- lib/active_support/core_ext/hash.rb
 - lib/active_support/core_ext/hash/conversions.rb
 - lib/active_support/core_ext/hash/deep_dup.rb
 - lib/active_support/core_ext/hash/deep_merge.rb
@@ -113,19 +116,19 @@ files:
 - lib/active_support/core_ext/hash/keys.rb
 - lib/active_support/core_ext/hash/reverse_merge.rb
 - lib/active_support/core_ext/hash/slice.rb
-- lib/active_support/core_ext/hash.rb
+- lib/active_support/core_ext/integer.rb
 - lib/active_support/core_ext/integer/inflections.rb
 - lib/active_support/core_ext/integer/multiple.rb
 - lib/active_support/core_ext/integer/time.rb
-- lib/active_support/core_ext/integer.rb
 - lib/active_support/core_ext/io.rb
+- lib/active_support/core_ext/kernel.rb
 - lib/active_support/core_ext/kernel/agnostics.rb
 - lib/active_support/core_ext/kernel/debugger.rb
 - lib/active_support/core_ext/kernel/reporting.rb
 - lib/active_support/core_ext/kernel/singleton_class.rb
-- lib/active_support/core_ext/kernel.rb
 - lib/active_support/core_ext/load_error.rb
 - lib/active_support/core_ext/logger.rb
+- lib/active_support/core_ext/module.rb
 - lib/active_support/core_ext/module/aliasing.rb
 - lib/active_support/core_ext/module/anonymous.rb
 - lib/active_support/core_ext/module/attr_internal.rb
@@ -138,11 +141,11 @@ files:
 - lib/active_support/core_ext/module/reachable.rb
 - lib/active_support/core_ext/module/remove_method.rb
 - lib/active_support/core_ext/module/synchronization.rb
-- lib/active_support/core_ext/module.rb
 - lib/active_support/core_ext/name_error.rb
+- lib/active_support/core_ext/numeric.rb
 - lib/active_support/core_ext/numeric/bytes.rb
 - lib/active_support/core_ext/numeric/time.rb
-- lib/active_support/core_ext/numeric.rb
+- lib/active_support/core_ext/object.rb
 - lib/active_support/core_ext/object/acts_like.rb
 - lib/active_support/core_ext/object/blank.rb
 - lib/active_support/core_ext/object/conversions.rb
@@ -154,18 +157,18 @@ files:
 - lib/active_support/core_ext/object/to_query.rb
 - lib/active_support/core_ext/object/try.rb
 - lib/active_support/core_ext/object/with_options.rb
-- lib/active_support/core_ext/object.rb
 - lib/active_support/core_ext/proc.rb
-- lib/active_support/core_ext/process/daemon.rb
 - lib/active_support/core_ext/process.rb
+- lib/active_support/core_ext/process/daemon.rb
+- lib/active_support/core_ext/range.rb
 - lib/active_support/core_ext/range/blockless_step.rb
 - lib/active_support/core_ext/range/conversions.rb
 - lib/active_support/core_ext/range/cover.rb
 - lib/active_support/core_ext/range/include_range.rb
 - lib/active_support/core_ext/range/overlaps.rb
-- lib/active_support/core_ext/range.rb
 - lib/active_support/core_ext/regexp.rb
 - lib/active_support/core_ext/rexml.rb
+- lib/active_support/core_ext/string.rb
 - lib/active_support/core_ext/string/access.rb
 - lib/active_support/core_ext/string/behavior.rb
 - lib/active_support/core_ext/string/conversions.rb
@@ -180,7 +183,6 @@ files:
 - lib/active_support/core_ext/string/starts_ends_with.rb
 - lib/active_support/core_ext/string/strip.rb
 - lib/active_support/core_ext/string/xchar.rb
-- lib/active_support/core_ext/string.rb
 - lib/active_support/core_ext/time/acts_like.rb
 - lib/active_support/core_ext/time/calculations.rb
 - lib/active_support/core_ext/time/conversions.rb
@@ -188,14 +190,13 @@ files:
 - lib/active_support/core_ext/time/publicize_conversion_methods.rb
 - lib/active_support/core_ext/time/zones.rb
 - lib/active_support/core_ext/uri.rb
-- lib/active_support/core_ext.rb
-- lib/active_support/dependencies/autoload.rb
 - lib/active_support/dependencies.rb
+- lib/active_support/dependencies/autoload.rb
+- lib/active_support/deprecation.rb
 - lib/active_support/deprecation/behaviors.rb
 - lib/active_support/deprecation/method_wrappers.rb
 - lib/active_support/deprecation/proxy_wrappers.rb
 - lib/active_support/deprecation/reporting.rb
-- lib/active_support/deprecation.rb
 - lib/active_support/descendants_tracker.rb
 - lib/active_support/duration.rb
 - lib/active_support/file_update_checker.rb
@@ -205,35 +206,36 @@ files:
 - lib/active_support/i18n.rb
 - lib/active_support/i18n_railtie.rb
 - lib/active_support/inflections.rb
+- lib/active_support/inflector.rb
 - lib/active_support/inflector/inflections.rb
 - lib/active_support/inflector/methods.rb
 - lib/active_support/inflector/transliterate.rb
-- lib/active_support/inflector.rb
+- lib/active_support/json.rb
 - lib/active_support/json/decoding.rb
 - lib/active_support/json/encoding.rb
 - lib/active_support/json/variable.rb
-- lib/active_support/json.rb
 - lib/active_support/lazy_load_hooks.rb
 - lib/active_support/locale/en.yml
-- lib/active_support/log_subscriber/test_helper.rb
 - lib/active_support/log_subscriber.rb
+- lib/active_support/log_subscriber/test_helper.rb
 - lib/active_support/memoizable.rb
 - lib/active_support/message_encryptor.rb
 - lib/active_support/message_verifier.rb
+- lib/active_support/multibyte.rb
 - lib/active_support/multibyte/chars.rb
 - lib/active_support/multibyte/exceptions.rb
 - lib/active_support/multibyte/unicode.rb
 - lib/active_support/multibyte/utils.rb
-- lib/active_support/multibyte.rb
+- lib/active_support/notifications.rb
 - lib/active_support/notifications/fanout.rb
 - lib/active_support/notifications/instrumenter.rb
-- lib/active_support/notifications.rb
 - lib/active_support/option_merger.rb
 - lib/active_support/ordered_hash.rb
 - lib/active_support/ordered_options.rb
 - lib/active_support/railtie.rb
 - lib/active_support/rescuable.rb
 - lib/active_support/ruby/shim.rb
+- lib/active_support/security_utils.rb
 - lib/active_support/string_inquirer.rb
 - lib/active_support/tagged_logging.rb
 - lib/active_support/test_case.rb
@@ -243,28 +245,27 @@ files:
 - lib/active_support/testing/isolation.rb
 - lib/active_support/testing/mochaing.rb
 - lib/active_support/testing/pending.rb
+- lib/active_support/testing/performance.rb
 - lib/active_support/testing/performance/jruby.rb
 - lib/active_support/testing/performance/rubinius.rb
+- lib/active_support/testing/performance/ruby.rb
 - lib/active_support/testing/performance/ruby/mri.rb
 - lib/active_support/testing/performance/ruby/yarv.rb
-- lib/active_support/testing/performance/ruby.rb
-- lib/active_support/testing/performance.rb
 - lib/active_support/testing/setup_and_teardown.rb
-- lib/active_support/time/autoload.rb
 - lib/active_support/time.rb
+- lib/active_support/time/autoload.rb
 - lib/active_support/time_with_zone.rb
 - lib/active_support/values/time_zone.rb
 - lib/active_support/values/unicode_tables.dat
 - lib/active_support/version.rb
 - lib/active_support/whiny_nil.rb
+- lib/active_support/xml_mini.rb
 - lib/active_support/xml_mini/jdom.rb
 - lib/active_support/xml_mini/libxml.rb
 - lib/active_support/xml_mini/libxmlsax.rb
 - lib/active_support/xml_mini/nokogiri.rb
 - lib/active_support/xml_mini/nokogirisax.rb
 - lib/active_support/xml_mini/rexml.rb
-- lib/active_support/xml_mini.rb
-- lib/active_support.rb
 homepage: http://www.rubyonrails.org
 licenses:
 - MIT
@@ -287,9 +288,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.2
+rubygems_version: 2.6.6
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.
 test_files: []
+has_rdoc: