activesupport 6.1.7.4 → 6.1.7.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c02edb464fd7298d03b7f713edbd402bb60fb2c1af8e31313123a1f53281b12
-  data.tar.gz: 05e7df7c00901311db3e93187606c0a289fdc06bdd1dd2cab677e0a89ab8277b
+  metadata.gz: 50f5efd72f46cf935dc874e11487132fc9b5c9902b37dc46872870caa81a6422
+  data.tar.gz: 4750820448d01bde16a5e0a78838c533c25853bd53fdb1dd5111d2fdd5e5426d
 SHA512:
-  metadata.gz: 84e1bb889b69a6e167174865b1b59f46564bf16894c688f411efcbcafbd7cc0e9d579e78d5371bd014fd5af4cf26dd307ae3044b4a03a4209681d08901ce51e0
-  data.tar.gz: fb9fd3de9aea9a3c2f2b96685ca432a5275a7b3a5bdb7915854983e3766b7300358f77bd6db07dd045a4b3df1d20383723e4ce30dbc1048656ec8dbe7389dde2
+  metadata.gz: cf5d62469082793f4550e0f2555679789e6aa789e1dc6dee60f32d2afade68ffc7bf237acb1a977fb3b4091bfb4c3af8c445bc1051389376778d5b73a1b4981d
+  data.tar.gz: cdbd01f5e83dc41934164def6be162f8402e71117f8dd5df2fcb16383e71e9183e2179da07e24428f86259dbe6655bbfa56ba5eb87c21f338a1a34804f61ccde

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## Rails 6.1.7.6 (August 22, 2023) ##
+
+*   No changes.
+
+
+## Rails 6.1.7.5 (August 22, 2023) ##
+
+*   Use a temporary file for storing unencrypted files while editing
+
+    [CVE-2023-38037]
+
+
 ## Rails 6.1.7.4 (June 26, 2023) ##
 
 *   No changes.

data/lib/active_support/encrypted_file.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "tmpdir"
+require "tempfile"
 require "active_support/message_encryptor"
 
 module ActiveSupport
@@ -69,17 +69,16 @@ module ActiveSupport
 
     private
       def writing(contents)
-        tmp_file = "#{Process.pid}.#{content_path.basename.to_s.chomp('.enc')}"
-        tmp_path = Pathname.new File.join(Dir.tmpdir, tmp_file)
-        tmp_path.binwrite contents
+        Tempfile.create(["", "-" + content_path.basename.to_s.chomp(".enc")]) do |tmp_file|
+          tmp_path = Pathname.new(tmp_file)
+          tmp_path.binwrite contents
 
-        yield tmp_path
+          yield tmp_path
 
-        updated_contents = tmp_path.binread
+          updated_contents = tmp_path.binread
 
-        write(updated_contents) if updated_contents != contents
-      ensure
-        FileUtils.rm(tmp_path) if tmp_path&.exist?
+          write(updated_contents) if updated_contents != contents
+        end
       end
 
 

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 6
     MINOR = 1
     TINY  = 7
-    PRE   = "4"
+    PRE   = "6"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 6.1.7.4
+  version: 6.1.7.6
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-06-26 00:00:00.000000000 Z
+date: 2023-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -357,10 +357,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.4/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.7.4/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.6/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.6/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.4/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.6/activesupport
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: