activesupport 5.2.7 → 5.2.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ca8c97dbd9b8c0060fa8fdc9fe0a265e52dade43f834a64d81be63a58631d52
-  data.tar.gz: 718c11ac32f5ede2cf74701c236afae41cd9ad50d8eb3d138594c869cb543462
+  metadata.gz: ea1c62125d4eed1ceaae18f625fa26bbac389b8d3f21ff0adb2939edacb8f018
+  data.tar.gz: 90be025c1783d49dfedbf500ae7d46e1d2fd13c3b65146837aad5c2361b8d9d9
 SHA512:
-  metadata.gz: 9390ba51ca2fec524ab28bf67f75ec75ef44c6599311c16c09b14a9a29cfe4d71732bd0a5fd31bea4b8d6e5bc5bfd5c12c06101aee7cc4f7cae3d203de9bb7a7
-  data.tar.gz: 39569f88617d0c8bcae4f85b461ce38f355533d1eb9484848a3c38ceb553e365adf8b2a34788d4705b6ae7fd75ee315262b3f889dae919a9bbd28238f56732aa
+  metadata.gz: 281dd51d00b06b84405bd78c57f35f057f8f18f0f760c4de513f90588af0c99032a5f2b36158fb909285d27f41e0911d6a132687c1666bdf510a8b0d9aee709d
+  data.tar.gz: fd36e776f1a952d3f86a0c231ff6384d643968e6fcba438ffdbccdd0916949f92059cd040f4bea1ca99a715213b587a7652e58bd76b8f2cb00706f31d32a3299

data/CHANGELOG.md

@@ -1,3 +1,23 @@
+## Rails 5.2.8.1 (July 12, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.8 (May 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.7.1 (April 26, 2022) ##
+
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
+
+    Add the method `ERB::Util.xml_name_escape` to escape dangerous characters
+    in names of tags and names of attributes, following the specification of XML.
+
+    *Álvaro Martín Fraguas*
+
+
 ## Rails 5.2.7 (March 10, 2022) ##
 
 *   Restore support to Ruby 2.2.

data/lib/active_support/concurrency/load_interlock_aware_monitor.rb

@@ -7,11 +7,29 @@ module ActiveSupport
     # A monitor that will permit dependency loading while blocked waiting for
     # the lock.
     class LoadInterlockAwareMonitor < Monitor
+      EXCEPTION_NEVER = { Exception => :never }.freeze
+      EXCEPTION_IMMEDIATE = { Exception => :immediate }.freeze
+      private_constant :EXCEPTION_NEVER, :EXCEPTION_IMMEDIATE
+
       # Enters an exclusive section, but allows dependency loading while blocked
       def mon_enter
         mon_try_enter ||
           ActiveSupport::Dependencies.interlock.permit_concurrent_loads { super }
       end
+
+      def synchronize
+        Thread.handle_interrupt(EXCEPTION_NEVER) do
+          mon_enter
+
+          begin
+            Thread.handle_interrupt(EXCEPTION_IMMEDIATE) do
+              yield
+            end
+          ensure
+            mon_exit
+          end
+        end
+      end
     end
   end
 end

data/lib/active_support/core_ext/string/output_safety.rb

@@ -12,6 +12,14 @@ class ERB
     HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+)|(#[xX][\dA-Fa-f]+));)/
     JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
 
+    # Following XML requirements: https://www.w3.org/TR/REC-xml/#NT-Name
+    TAG_NAME_START_REGEXP_SET = "@:A-Z_a-z\u{C0}-\u{D6}\u{D8}-\u{F6}\u{F8}-\u{2FF}\u{370}-\u{37D}\u{37F}-\u{1FFF}" \
+                                "\u{200C}-\u{200D}\u{2070}-\u{218F}\u{2C00}-\u{2FEF}\u{3001}-\u{D7FF}\u{F900}-\u{FDCF}" \
+                                "\u{FDF0}-\u{FFFD}\u{10000}-\u{EFFFF}"
+    TAG_NAME_START_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}]/
+    TAG_NAME_FOLLOWING_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}\-.0-9\u{B7}\u{0300}-\u{036F}\u{203F}-\u{2040}]/
+    TAG_NAME_REPLACEMENT_CHAR = "_"
+
     # A utility method for escaping HTML tag characters.
     # This method is also aliased as <tt>h</tt>.
     #
@@ -116,6 +124,26 @@ class ERB
     end
 
     module_function :json_escape
+
+    # A utility method for escaping XML names of tags and names of attributes.
+    #
+    #   xml_name_escape('1 < 2 & 3')
+    #   # => "1___2___3"
+    #
+    # It follows the requirements of the specification: https://www.w3.org/TR/REC-xml/#NT-Name
+    def xml_name_escape(name)
+      name = name.to_s
+      return "" if name.blank?
+
+      starting_char = name[0].gsub(TAG_NAME_START_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      return starting_char if name.size == 1
+
+      following_chars = name[1..-1].gsub(TAG_NAME_FOLLOWING_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      starting_char + following_chars
+    end
+    module_function :xml_name_escape
   end
 end
 

data/lib/active_support/gem_version.rb

@@ -9,8 +9,8 @@ module ActiveSupport
   module VERSION
     MAJOR = 5
     MINOR = 2
-    TINY  = 7
-    PRE   = nil
+    TINY  = 8
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 5.2.7
+  version: 5.2.8.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-10 00:00:00.000000000 Z
+date: 2022-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -333,9 +333,9 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.7/activesupport
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.7/activesupport/CHANGELOG.md
-post_install_message: 
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.8.1/activesupport
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.8.1/activesupport/CHANGELOG.md
+post_install_message:
 rdoc_options:
 - "--encoding"
 - UTF-8
@@ -352,8 +352,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.