activesupport 6.0.3 → 6.0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ecaab093a95934f616bf961543b5b996df6129688365994127affb9b0f7b18b
-  data.tar.gz: 4e200bc745348e0a45f8e52a570376d3da4316f1d68751f109e09c19eaa963b8
+  metadata.gz: 27ca64902752919c07141c16dfbcdc8778c7ebe2d4ff731d08929496e5c361b6
+  data.tar.gz: 61da30389c58c0aada87afefa84c53aa7500cea25e7e275d1722356e88b151f1
 SHA512:
-  metadata.gz: a5a2525304c76190c7b8bb5a00f4a1ac9b96ab896f867b3f6db26ffd6e05ae389348947fee02e6c8ba53568f5e85425e69de51cd6d022732952266d0670de3bf
-  data.tar.gz: 92efcfa7ba82f282c64c42233de3e46aced59e113a4ec2f4d516e2f8cc104838f93cd2e7814a05b4088d600289b719ef4f518b38a93db43210e78667743173f3
+  metadata.gz: 8444e314fb626748d3d2350b9d91e634a3ddf1822858aef8c5d7c2eda762c1fb92416dfc5d326c2a112e3ef034be0cb79006d745c2aaae09a214ba02f1a639bc
+  data.tar.gz: 7de5b2431cfab0e6bc39fa3ccaa2234c8fb0b495fda4438cc371e0e27308855026894e5b1de400365f394994ac9567bf97efe9a9c3ed48aa1e8c9195d9c7c145

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Rails 6.0.3.1 (May 18, 2020) ##
+
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
+
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   `Array#to_sentence` no longer returns a frozen string.

data/lib/active_support/cache/mem_cache_store.rb

@@ -7,7 +7,6 @@ rescue LoadError => e
   raise e
 end
 
-require "active_support/core_ext/marshal"
 require "active_support/core_ext/array/extract_options"
 
 module ActiveSupport
@@ -28,14 +27,6 @@ module ActiveSupport
       # Provide support for raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, **options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, **options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(entry.value.to_s)
@@ -194,9 +185,8 @@ module ActiveSupport
           key
         end
 
-        def deserialize_entry(raw_value)
-          if raw_value
-            entry = Marshal.load(raw_value) rescue raw_value
+        def deserialize_entry(entry)
+          if entry
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/cache/redis_cache_store.rb

@@ -74,14 +74,6 @@ module ActiveSupport
       # Support raw values in the local cache strategy.
       module LocalCacheWithRaw # :nodoc:
         private
-          def read_entry(key, **options)
-            entry = super
-            if options[:raw] && local_cache && entry
-              entry = deserialize_entry(entry.value)
-            end
-            entry
-          end
-
           def write_entry(key, entry, **options)
             if options[:raw] && local_cache
               raw_entry = Entry.new(serialize_entry(entry, raw: true))
@@ -348,7 +340,8 @@ module ActiveSupport
         # Read an entry from the cache.
         def read_entry(key, **options)
           failsafe :read_entry do
-            deserialize_entry redis.with { |c| c.get(key) }
+            raw = options&.fetch(:raw, false)
+            deserialize_entry(redis.with { |c| c.get(key) }, raw: raw)
           end
         end
 
@@ -364,6 +357,7 @@ module ActiveSupport
           options = names.extract_options!
           options = merged_options(options)
           return {} if names == []
+          raw = options&.fetch(:raw, false)
 
           keys = names.map { |name| normalize_key(name, options) }
 
@@ -373,7 +367,7 @@ module ActiveSupport
 
           names.zip(values).each_with_object({}) do |(name, value), results|
             if value
-              entry = deserialize_entry(value)
+              entry = deserialize_entry(value, raw: raw)
               unless entry.nil? || entry.expired? || entry.mismatched?(normalize_version(name, options))
                 results[name] = entry.value
               end
@@ -448,9 +442,20 @@ module ActiveSupport
           end
         end
 
-        def deserialize_entry(serialized_entry)
+        def deserialize_entry(serialized_entry, raw:)
           if serialized_entry
             entry = Marshal.load(serialized_entry) rescue serialized_entry
+
+            written_raw = serialized_entry.equal?(entry)
+            if raw != written_raw
+              ActiveSupport::Deprecation.warn(<<-MSG.squish)
+                Using a different value for the raw option when reading and writing
+                to a cache key is deprecated for :redis_cache_store and Rails 6.0
+                will stop automatically detecting the format when reading to avoid
+                marshal loading untrusted raw strings.
+              MSG
+            end
+
             entry.is_a?(Entry) ? entry : Entry.new(entry)
           end
         end

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 6.0.3
+  version: 6.0.3.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-06 00:00:00.000000000 Z
+date: 2020-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -359,10 +359,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.1/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.1/activesupport
 post_install_message: 
 rdoc_options:
 - "--encoding"