activesupport 6.1.5 → 6.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b3babd75cfe9eba9446aa952df30fa9e7a6b8ace1d63022314a7cd9be07eeb6
-  data.tar.gz: 16ad9c941a3643fdb30602b5ffea85aedc9306babaaf5caccee7041726df0a89
+  metadata.gz: 86fc82a4ac7a8ff4945e8433ea6873e1d9325b470ad7ac8d7310c73370a4f01d
+  data.tar.gz: 62f8370923132917f2d665eb09bf1975db08a335d951013cbfaa15077b778d6e
 SHA512:
-  metadata.gz: c362a52ce66fc84e04216656f8919cc39e22280fe7a5f2e0daf1f228ee503be30caf7b942bb7c8ca9445f0aed6604cf6cc8d048c9a9cc9154a91f284e17518db
-  data.tar.gz: bc8e7c37926b6c30b80ae39d22f0c57fb756e1fd8faebdd5047196afe7508b0ff86691c970f0db3c100e741445b76cb1366bda1dda6ecfc9b5a6ea574415e097
+  metadata.gz: ac345691c68306eb3fd83090e79e2794de25d1cf8a6caf34199d4bced1a144a11b670e1a1471dbfe6079c6a4acab76d36d9f2aefc05ad5539f180048a45029ad
+  data.tar.gz: 0ebb0c6a75f4c1664e673927a50dc3506915f17667bc6768535365b80f1d775f13a07b74150725eb6e24a117deae15566a4d40471bfea2678b11c213503429f1

data/CHANGELOG.md

@@ -1,3 +1,27 @@
+## Rails 6.1.7 (September 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.1.6.1 (July 12, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.1.6 (May 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 6.1.5.1 (April 26, 2022) ##
+
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
+
+    Add the method `ERB::Util.xml_name_escape` to escape dangerous characters
+    in names of tags and names of attributes, following the specification of XML.
+
+    *Álvaro Martín Fraguas*
+
 ## Rails 6.1.5 (March 09, 2022) ##
 
 *   Fix `ActiveSupport::Duration.build` to support negative values.

data/lib/active_support/core_ext/string/output_safety.rb

@@ -11,6 +11,14 @@ class ERB
     HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+)|(#[xX][\dA-Fa-f]+));)/
     JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
 
+    # Following XML requirements: https://www.w3.org/TR/REC-xml/#NT-Name
+    TAG_NAME_START_REGEXP_SET = "@:A-Z_a-z\u{C0}-\u{D6}\u{D8}-\u{F6}\u{F8}-\u{2FF}\u{370}-\u{37D}\u{37F}-\u{1FFF}" \
+                                "\u{200C}-\u{200D}\u{2070}-\u{218F}\u{2C00}-\u{2FEF}\u{3001}-\u{D7FF}\u{F900}-\u{FDCF}" \
+                                "\u{FDF0}-\u{FFFD}\u{10000}-\u{EFFFF}"
+    TAG_NAME_START_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}]/
+    TAG_NAME_FOLLOWING_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}\-.0-9\u{B7}\u{0300}-\u{036F}\u{203F}-\u{2040}]/
+    TAG_NAME_REPLACEMENT_CHAR = "_"
+
     # A utility method for escaping HTML tag characters.
     # This method is also aliased as <tt>h</tt>.
     #
@@ -115,6 +123,26 @@ class ERB
     end
 
     module_function :json_escape
+
+    # A utility method for escaping XML names of tags and names of attributes.
+    #
+    #   xml_name_escape('1 < 2 & 3')
+    #   # => "1___2___3"
+    #
+    # It follows the requirements of the specification: https://www.w3.org/TR/REC-xml/#NT-Name
+    def xml_name_escape(name)
+      name = name.to_s
+      return "" if name.blank?
+
+      starting_char = name[0].gsub(TAG_NAME_START_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      return starting_char if name.size == 1
+
+      following_chars = name[1..-1].gsub(TAG_NAME_FOLLOWING_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      starting_char + following_chars
+    end
+    module_function :xml_name_escape
   end
 end
 

data/lib/active_support/current_attributes.rb

@@ -164,6 +164,7 @@ module ActiveSupport
 
           send(name, *args, &block)
         end
+        ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true)
     end
 
     attr_accessor :attributes

data/lib/active_support/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveSupport
   module VERSION
     MAJOR = 6
     MINOR = 1
-    TINY  = 5
+    TINY  = 7
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 6.1.5
+  version: 6.1.7
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-10 00:00:00.000000000 Z
+date: 2022-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -357,12 +357,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.5/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.5/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.5/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7/activesupport
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--encoding"
 - UTF-8
@@ -379,8 +379,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.