activesupport 5.2.4.2 → 5.2.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0dbc3c6455b658fef338e38b62badea8ee5fae2a3071bea878d00f0284c186ea
-  data.tar.gz: c0522d8c21a83712106d7d3f169af5cc00fe7b750c34bf479900c4577947fe23
+  metadata.gz: 52200cba1081f52ab46b0fbb797549ec4f37ec724232511041c17279af00c23a
+  data.tar.gz: 8f67df12d04d8a83698d73ba5c961058156000fc77f344f2c10bbdc0bb5d1bd3
 SHA512:
-  metadata.gz: 27b40fe00539e8920149a177fa29c5f073d90a86f61e2661519ce66549ac12564e91f81550329e163519229cfb36ba556e53ea6ddc1df10445cd968cc186c100
-  data.tar.gz: 4106e25be80a14d15a45d6ff0afbcaf0adc697770454ec4e5ad74f49032fb959d69fd27a84c63bf7c5a4c454329eb8fbf369b1524e06040481bf053a8652bdbe
+  metadata.gz: cb196f7b65d12c1a5be5178772fc9f449dd6408614bfa3020862e18ba32ed163597f4647202fdb792ab38a451dc04e5846072dc948e2a83505b2c7ccac4ee2d0
+  data.tar.gz: cfdf86850d1f2a9529d135756a23861b3bbb23c063b1446cbc994fb2372dfb2f79217eda99b0dc021d5cbfbd4f75f79a6e5385531f5dd48f1e78a1e55298459a

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Rails 5.2.4.3 (May 18, 2020) ##
+
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
+
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
+
 ## Rails 5.2.4.1 (December 18, 2019) ##
 
 *   No changes.

data/lib/active_support/cache/mem_cache_store.rb

@@ -7,7 +7,6 @@ rescue LoadError => e
   raise e
 end
 
-require "active_support/core_ext/marshal"
 require "active_support/core_ext/array/extract_options"
 
 module ActiveSupport
@@ -28,14 +27,6 @@ module ActiveSupport
       # Provide support for raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(entry.value.to_s)
@@ -189,9 +180,8 @@ module ActiveSupport
           key
         end
 
-        def deserialize_entry(raw_value)
-          if raw_value
-            entry = Marshal.load(raw_value) rescue raw_value
+        def deserialize_entry(entry)
+          if entry
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/cache/redis_cache_store.rb

@@ -70,14 +70,6 @@ module ActiveSupport
       # Support raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(serialize_entry(entry, raw: true))
@@ -328,7 +320,8 @@ module ActiveSupport
         # Read an entry from the cache.
         def read_entry(key, options = nil)
           failsafe :read_entry do
-            deserialize_entry redis.with { |c| c.get(key) }
+            raw = options&.fetch(:raw, false)
+            deserialize_entry(redis.with { |c| c.get(key) }, raw: raw)
           end
         end
 
@@ -343,6 +336,7 @@ module ActiveSupport
         def read_multi_mget(*names)
           options = names.extract_options!
           options = merged_options(options)
+          raw = options&.fetch(:raw, false)
 
           keys = names.map { |name| normalize_key(name, options) }
 
@@ -352,7 +346,7 @@ module ActiveSupport
 
           names.zip(values).each_with_object({}) do |(name, value), results|
             if value
-              entry = deserialize_entry(value)
+              entry = deserialize_entry(value, raw: raw)
               unless entry.nil? || entry.expired? || entry.mismatched?(normalize_version(name, options))
                 results[name] = entry.value
               end
@@ -421,9 +415,20 @@ module ActiveSupport
           end
         end
 
-        def deserialize_entry(serialized_entry)
+        def deserialize_entry(serialized_entry, raw:)
           if serialized_entry
             entry = Marshal.load(serialized_entry) rescue serialized_entry
+
+            written_raw = serialized_entry.equal?(entry)
+            if raw != written_raw
+              ActiveSupport::Deprecation.warn(<<-MSG.squish)
+                Using a different value for the raw option when reading and writing
+                to a cache key is deprecated for :redis_cache_store and Rails 6.0
+                will stop automatically detecting the format when reading to avoid
+                marshal loading untrusted raw strings.
+              MSG
+            end
+
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 5
     MINOR = 2
     TINY  = 4
-    PRE   = "2"
+    PRE   = "3"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 5.2.4.2
+  version: 5.2.4.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-19 00:00:00.000000000 Z
+date: 2020-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -333,8 +333,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.4.2/activesupport
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.4.2/activesupport/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.4.3/activesupport
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.4.3/activesupport/CHANGELOG.md
 post_install_message: 
 rdoc_options:
 - "--encoding"
@@ -352,7 +352,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the