activesupport 6.0.4.6 → 6.0.5
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of activesupport might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +20 -0
- data/lib/active_support/core_ext/string/output_safety.rb +28 -0
- data/lib/active_support/gem_version.rb +2 -2
- metadata +7 -6
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 98549201d21c2cbb0462067a1139efc195a1284285dad8754d677c94338920e1
|
4
|
+
data.tar.gz: 13a970e567138812240a037ec834fcabe70c2f08534293e2d2a17650f3839039
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 631b92bd5bac507e9dc5c45faa85387c48421dca015e005bfe5d602d64582f684d74a85ce1de8dbd03374c0e90a833af48cdbd8f5cd523e11660e9f29529d2b3
|
7
|
+
data.tar.gz: 234dae51927dc044d2c59247bbd93e6141be0498e5fd75d010c0903c1d7e237d520bf62696fe50e83528e99b82e36db9a346481bf4951f736c0f42d0b5185fce
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,23 @@
|
|
1
|
+
## Rails 6.0.5 (May 09, 2022) ##
|
2
|
+
|
3
|
+
* No changes.
|
4
|
+
|
5
|
+
|
6
|
+
## Rails 6.0.4.8 (April 26, 2022) ##
|
7
|
+
|
8
|
+
* Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
|
9
|
+
|
10
|
+
Add the method `ERB::Util.xml_name_escape` to escape dangerous characters
|
11
|
+
in names of tags and names of attributes, following the specification of XML.
|
12
|
+
|
13
|
+
*Álvaro Martín Fraguas*
|
14
|
+
|
15
|
+
|
16
|
+
## Rails 6.0.4.7 (March 08, 2022) ##
|
17
|
+
|
18
|
+
* No changes.
|
19
|
+
|
20
|
+
|
1
21
|
## Rails 6.0.4.6 (February 11, 2022) ##
|
2
22
|
|
3
23
|
* Fix Reloader method signature to work with the new Executor signature
|
@@ -12,6 +12,14 @@ class ERB
|
|
12
12
|
HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+)|(#[xX][\dA-Fa-f]+));)/
|
13
13
|
JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
|
14
14
|
|
15
|
+
# Following XML requirements: https://www.w3.org/TR/REC-xml/#NT-Name
|
16
|
+
TAG_NAME_START_REGEXP_SET = "@:A-Z_a-z\u{C0}-\u{D6}\u{D8}-\u{F6}\u{F8}-\u{2FF}\u{370}-\u{37D}\u{37F}-\u{1FFF}" \
|
17
|
+
"\u{200C}-\u{200D}\u{2070}-\u{218F}\u{2C00}-\u{2FEF}\u{3001}-\u{D7FF}\u{F900}-\u{FDCF}" \
|
18
|
+
"\u{FDF0}-\u{FFFD}\u{10000}-\u{EFFFF}"
|
19
|
+
TAG_NAME_START_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}]/
|
20
|
+
TAG_NAME_FOLLOWING_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}\-.0-9\u{B7}\u{0300}-\u{036F}\u{203F}-\u{2040}]/
|
21
|
+
TAG_NAME_REPLACEMENT_CHAR = "_"
|
22
|
+
|
15
23
|
# A utility method for escaping HTML tag characters.
|
16
24
|
# This method is also aliased as <tt>h</tt>.
|
17
25
|
#
|
@@ -116,6 +124,26 @@ class ERB
|
|
116
124
|
end
|
117
125
|
|
118
126
|
module_function :json_escape
|
127
|
+
|
128
|
+
# A utility method for escaping XML names of tags and names of attributes.
|
129
|
+
#
|
130
|
+
# xml_name_escape('1 < 2 & 3')
|
131
|
+
# # => "1___2___3"
|
132
|
+
#
|
133
|
+
# It follows the requirements of the specification: https://www.w3.org/TR/REC-xml/#NT-Name
|
134
|
+
def xml_name_escape(name)
|
135
|
+
name = name.to_s
|
136
|
+
return "" if name.blank?
|
137
|
+
|
138
|
+
starting_char = name[0].gsub(TAG_NAME_START_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
|
139
|
+
|
140
|
+
return starting_char if name.size == 1
|
141
|
+
|
142
|
+
following_chars = name[1..-1].gsub(TAG_NAME_FOLLOWING_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
|
143
|
+
|
144
|
+
starting_char + following_chars
|
145
|
+
end
|
146
|
+
module_function :xml_name_escape
|
119
147
|
end
|
120
148
|
end
|
121
149
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: activesupport
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 6.0.
|
4
|
+
version: 6.0.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- David Heinemeier Hansson
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-05-09 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: i18n
|
@@ -359,10 +359,11 @@ licenses:
|
|
359
359
|
- MIT
|
360
360
|
metadata:
|
361
361
|
bug_tracker_uri: https://github.com/rails/rails/issues
|
362
|
-
changelog_uri: https://github.com/rails/rails/blob/v6.0.
|
363
|
-
documentation_uri: https://api.rubyonrails.org/v6.0.
|
362
|
+
changelog_uri: https://github.com/rails/rails/blob/v6.0.5/activesupport/CHANGELOG.md
|
363
|
+
documentation_uri: https://api.rubyonrails.org/v6.0.5/
|
364
364
|
mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
|
365
|
-
source_code_uri: https://github.com/rails/rails/tree/v6.0.
|
365
|
+
source_code_uri: https://github.com/rails/rails/tree/v6.0.5/activesupport
|
366
|
+
rubygems_mfa_required: 'true'
|
366
367
|
post_install_message:
|
367
368
|
rdoc_options:
|
368
369
|
- "--encoding"
|
@@ -380,7 +381,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
380
381
|
- !ruby/object:Gem::Version
|
381
382
|
version: '0'
|
382
383
|
requirements: []
|
383
|
-
rubygems_version: 3.
|
384
|
+
rubygems_version: 3.3.7
|
384
385
|
signing_key:
|
385
386
|
specification_version: 4
|
386
387
|
summary: A toolkit of support libraries and Ruby core extensions extracted from the
|