activesupport 5.2.4 → 5.2.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fd0afb64741d8e794acec9c74cca9ed2526e30ac7c78e5b66135bfc2567a187
-  data.tar.gz: 33b2caf831d3c6907351646dbe4ab033b810adcdf0737a627e712b50782b7ed7
+  metadata.gz: 9eaca090b97477eb47dc519cdd74b4aceb3bc6c9d7f1f9c81b86a5cd000979fc
+  data.tar.gz: 1841fae4b6c08dba4845202e96f28096e289da5a2a19fe98cdfb1456361bd72e
 SHA512:
-  metadata.gz: 5a78f3d685d14d51a926f0cc38d800bc0440d8f71fd1198fbe9842cccfb12875b4930377da6681518aa4c473bbc0a0cd8b65067916dedbf7a7b07a1815fcc1b6
-  data.tar.gz: 4c32299fa0aa0c61e5a415c10aa152b3bb9bf286b3836914fed1458fb43183ad8ee38908dd0af59403edfc3f062dc5f4e11772305f1abc599f3ddd0c90c211dc
+  metadata.gz: c0d5e35f172cec406ddb9dfec8c552c9d67d20519dab0cc9422f65ecc32c55a4cc750e82cb17ca12e381ade6051b64ba48f30f85165172fc50a9796206cc0a83
+  data.tar.gz: b3de3b8b17d0c886ec898dd7c1d1c7585f29e55bbd05186a2eeeb5e96ee43a7b05ba44be337ecc2a0413a37432ecfe7e887c41f06e4a82d1abac5b542472dcf7

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Rails 5.2.4.5 (February 10, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.4 (September 09, 2020) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.3 (May 18, 2020) ##
+
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
+
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
+
+## Rails 5.2.4.1 (December 18, 2019) ##
+
+*   No changes.
+
+
 ## Rails 5.2.4 (November 27, 2019) ##
 
 *   Make ActiveSupport::Logger Fiber-safe. Fixes #36752.

data/lib/active_support/cache/mem_cache_store.rb

@@ -7,7 +7,6 @@ rescue LoadError => e
   raise e
 end
 
-require "active_support/core_ext/marshal"
 require "active_support/core_ext/array/extract_options"
 
 module ActiveSupport
@@ -28,14 +27,6 @@ module ActiveSupport
       # Provide support for raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(entry.value.to_s)
@@ -189,9 +180,8 @@ module ActiveSupport
           key
         end
 
-        def deserialize_entry(raw_value)
-          if raw_value
-            entry = Marshal.load(raw_value) rescue raw_value
+        def deserialize_entry(entry)
+          if entry
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/cache/redis_cache_store.rb

@@ -70,14 +70,6 @@ module ActiveSupport
       # Support raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(serialize_entry(entry, raw: true))
@@ -328,7 +320,8 @@ module ActiveSupport
         # Read an entry from the cache.
         def read_entry(key, options = nil)
           failsafe :read_entry do
-            deserialize_entry redis.with { |c| c.get(key) }
+            raw = options&.fetch(:raw, false)
+            deserialize_entry(redis.with { |c| c.get(key) }, raw: raw)
           end
         end
 
@@ -343,6 +336,7 @@ module ActiveSupport
         def read_multi_mget(*names)
           options = names.extract_options!
           options = merged_options(options)
+          raw = options&.fetch(:raw, false)
 
           keys = names.map { |name| normalize_key(name, options) }
 
@@ -352,7 +346,7 @@ module ActiveSupport
 
           names.zip(values).each_with_object({}) do |(name, value), results|
             if value
-              entry = deserialize_entry(value)
+              entry = deserialize_entry(value, raw: raw)
               unless entry.nil? || entry.expired? || entry.mismatched?(normalize_version(name, options))
                 results[name] = entry.value
               end
@@ -421,9 +415,20 @@ module ActiveSupport
           end
         end
 
-        def deserialize_entry(serialized_entry)
+        def deserialize_entry(serialized_entry, raw:)
           if serialized_entry
             entry = Marshal.load(serialized_entry) rescue serialized_entry
+
+            written_raw = serialized_entry.equal?(entry)
+            if raw != written_raw
+              ActiveSupport::Deprecation.warn(<<-MSG.squish)
+                Using a different value for the raw option when reading and writing
+                to a cache key is deprecated for :redis_cache_store and Rails 6.0
+                will stop automatically detecting the format when reading to avoid
+                marshal loading untrusted raw strings.
+              MSG
+            end
+
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 5
     MINOR = 2
     TINY  = 4
-    PRE   = nil
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 5.2.4
+  version: 5.2.4.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-27 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -333,8 +333,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.4/activesupport
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.4/activesupport/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.4.5/activesupport
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.4.5/activesupport/CHANGELOG.md
 post_install_message: 
 rdoc_options:
 - "--encoding"