activesupport 5.2.4.1 → 5.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63ec42059f6cf3bef91cddb9342a4c0aa51761a2553f932919e283a6a1e70a19
-  data.tar.gz: 34241f0f3751d1381cb22f792290528cc809530f3aade8937d0e6a60b14654f1
+  metadata.gz: 7e0fa29c7295e4a4402a7e6c2db46a0179f35b3b68125888a6cc191b186af251
+  data.tar.gz: b1683c3540effb16dd44128bb9f0986388f21ff777e0b3a44eae779160aaf45f
 SHA512:
-  metadata.gz: fc8171b6755b13497efdb76430c925b66bdd16ea4440ac2a3625e03655aa63394aad91a4bddcfee030bfd6d2a130bfc31654b6c08fcf0ba4f8b541a29627a74c
-  data.tar.gz: c0021f8f84d535d8aad50c3561a959c3ba4485a4a6bcd0dfeeb92fb316369b6db49e10c8c7ef4f616efe75d17748194bd1ccb96e8870aefc2f4f167b82048110
+  metadata.gz: 6b323c40a81203c83c422534df283d010d1f544787277cf914008353a8c5437dfba3b688176512a197af31df312c5a0e56f06b7fa19578ba4ff78189fd05041b
+  data.tar.gz: 3ad31799a6a8f24dabac77889a5d0b5e2c6f4fe818426abe4aa98a26a307159cf79ff03eb44af5bf3ea84efd7c6604fbe2240366c98cc3f0575fc7fe628132f4

data/CHANGELOG.md

@@ -1,3 +1,29 @@
+## Rails 5.2.5 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.5 (February 10, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.4 (September 09, 2020) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.3 (May 18, 2020) ##
+
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
+
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
+
+## Rails 5.2.4.2 (March 19, 2020) ##
+
+*   No changes.
+
+
 ## Rails 5.2.4.1 (December 18, 2019) ##
 
 *   No changes.

data/lib/active_support/cache/mem_cache_store.rb

@@ -28,14 +28,6 @@ module ActiveSupport
       # Provide support for raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(entry.value.to_s)
@@ -189,9 +181,8 @@ module ActiveSupport
           key
         end
 
-        def deserialize_entry(raw_value)
-          if raw_value
-            entry = Marshal.load(raw_value) rescue raw_value
+        def deserialize_entry(entry)
+          if entry
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/cache/redis_cache_store.rb

@@ -70,14 +70,6 @@ module ActiveSupport
       # Support raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(serialize_entry(entry, raw: true))
@@ -328,7 +320,8 @@ module ActiveSupport
         # Read an entry from the cache.
         def read_entry(key, options = nil)
           failsafe :read_entry do
-            deserialize_entry redis.with { |c| c.get(key) }
+            raw = options && options.fetch(:raw, false)
+            deserialize_entry(redis.with { |c| c.get(key) }, raw: raw)
           end
         end
 
@@ -343,6 +336,7 @@ module ActiveSupport
         def read_multi_mget(*names)
           options = names.extract_options!
           options = merged_options(options)
+          raw = options && options.fetch(:raw, false)
 
           keys = names.map { |name| normalize_key(name, options) }
 
@@ -352,7 +346,7 @@ module ActiveSupport
 
           names.zip(values).each_with_object({}) do |(name, value), results|
             if value
-              entry = deserialize_entry(value)
+              entry = deserialize_entry(value, raw: raw)
               unless entry.nil? || entry.expired? || entry.mismatched?(normalize_version(name, options))
                 results[name] = entry.value
               end
@@ -421,9 +415,20 @@ module ActiveSupport
           end
         end
 
-        def deserialize_entry(serialized_entry)
+        def deserialize_entry(serialized_entry, raw:)
           if serialized_entry
             entry = Marshal.load(serialized_entry) rescue serialized_entry
+
+            written_raw = serialized_entry.equal?(entry)
+            if raw != written_raw
+              ActiveSupport::Deprecation.warn(<<-MSG.squish)
+                Using a different value for the raw option when reading and writing
+                to a cache key is deprecated for :redis_cache_store and Rails 6.0
+                will stop automatically detecting the format when reading to avoid
+                marshal loading untrusted raw strings.
+              MSG
+            end
+
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/duration.rb

@@ -183,15 +183,15 @@ module ActiveSupport
       #
       def build(value)
         parts = {}
-        remainder = value.to_f
+        remainder = value.round(9)
 
         PARTS.each do |part|
           unless part == :seconds
             part_in_seconds = PARTS_IN_SECONDS[part]
             parts[part] = remainder.div(part_in_seconds)
-            remainder = (remainder % part_in_seconds).round(9)
+            remainder %= part_in_seconds
           end
-        end
+        end unless value == 0
 
         parts[:seconds] = remainder
 
@@ -210,7 +210,7 @@ module ActiveSupport
     def initialize(value, parts) #:nodoc:
       @value, @parts = value, parts.to_h
       @parts.default = 0
-      @parts.reject! { |k, v| v.zero? }
+      @parts.reject! { |k, v| v.zero? } unless value == 0
     end
 
     def coerce(other) #:nodoc:
@@ -400,8 +400,14 @@ module ActiveSupport
     private
 
       def sum(sign, time = ::Time.current)
-        parts.inject(time) do |t, (type, number)|
-          if t.acts_like?(:time) || t.acts_like?(:date)
+        unless time.acts_like?(:time) || time.acts_like?(:date)
+          raise ::ArgumentError, "expected a time or date, got #{time.inspect}"
+        end
+
+        if parts.empty?
+          time.since(sign * value)
+        else
+          parts.inject(time) do |t, (type, number)|
             if type == :seconds
               t.since(sign * number)
             elsif type == :minutes
@@ -411,8 +417,6 @@ module ActiveSupport
             else
               t.advance(type => sign * number)
             end
-          else
-            raise ::ArgumentError, "expected a time or date, got #{time.inspect}"
           end
         end
       end

data/lib/active_support/gem_version.rb

@@ -9,8 +9,8 @@ module ActiveSupport
   module VERSION
     MAJOR = 5
     MINOR = 2
-    TINY  = 4
-    PRE   = "1"
+    TINY  = 5
+    PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 5.2.4.1
+  version: 5.2.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-18 00:00:00.000000000 Z
+date: 2021-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -333,8 +333,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.4.1/activesupport
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.4.1/activesupport/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.5/activesupport
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.5/activesupport/CHANGELOG.md
 post_install_message: 
 rdoc_options:
 - "--encoding"
@@ -352,7 +352,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the