activesupport 7.0.2.3 → 7.0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da403c75ed521630cf7259572515e2aac83fa7f5e325de6967925dcbd976a6e6
-  data.tar.gz: e74ff605a4151e4c4232d6193096e68c0de6fbbb633f68b7bc32184c95a13da7
+  metadata.gz: '02869b1bcaf37b6194486f794ee952cd0fc99be001f71f7aa6c2f883acbbb124'
+  data.tar.gz: b2819e4848cfeb61f674e89f2dbc734c1e3a06003b85f9e28153a4b1cf5d1c42
 SHA512:
-  metadata.gz: 74d16fb70cbe757fbdc24ef975611f1c0904fe09cf11bb6b6bb7bf62446a0b0a78af7d0ae2c4fb97f74e348fcda1585d279758159884c38da28c77653d789e9c
-  data.tar.gz: 39431adb807fc5e5a330265470cc702400ccab05581d2474486bc72e33d24785226863671616ce1da88dcd3d0979efd2660c79822516a6eab473c418de970b9b
+  metadata.gz: 8949b44a0afb53bc581e1df773c8a991b6c6f0e2533e1d7198686ff1013cc0e24cd203f26edd07a21c7a54edb30b8b8f537d2e17987533a66ccf7b8239d7fde3
+  data.tar.gz: 6199375f07c08dee86c37886c6b2e063d6cc8a65f326cb9697aefa97b85b4f4bce0ff4fe1f702c7b223c80e5fd1ef4c293f57dc35dd30a8e8159d74eafb1589d

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 7.0.2.4 (April 26, 2022) ##
+
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
+
+    Add the method `ERB::Util.xml_name_escape` to escape dangerous characters
+    in names of tags and names of attributes, following the specification of XML.
+
+    *Álvaro Martín Fraguas*
+
 ## Rails 7.0.2.3 (March 08, 2022) ##
 
 *   No changes.

data/lib/active_support/core_ext/string/output_safety.rb

@@ -11,6 +11,14 @@ class ERB
     HTML_ESCAPE_ONCE_REGEXP = /["><']|&(?!([a-zA-Z]+|(#\d+)|(#[xX][\dA-Fa-f]+));)/
     JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
 
+    # Following XML requirements: https://www.w3.org/TR/REC-xml/#NT-Name
+    TAG_NAME_START_REGEXP_SET = ":A-Z_a-z\u{C0}-\u{D6}\u{D8}-\u{F6}\u{F8}-\u{2FF}\u{370}-\u{37D}\u{37F}-\u{1FFF}" \
+                                "\u{200C}-\u{200D}\u{2070}-\u{218F}\u{2C00}-\u{2FEF}\u{3001}-\u{D7FF}\u{F900}-\u{FDCF}" \
+                                "\u{FDF0}-\u{FFFD}\u{10000}-\u{EFFFF}"
+    TAG_NAME_START_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}]/
+    TAG_NAME_FOLLOWING_REGEXP = /[^#{TAG_NAME_START_REGEXP_SET}\-.0-9\u{B7}\u{0300}-\u{036F}\u{203F}-\u{2040}]/
+    TAG_NAME_REPLACEMENT_CHAR = "_"
+
     # A utility method for escaping HTML tag characters.
     # This method is also aliased as <tt>h</tt>.
     #
@@ -115,6 +123,26 @@ class ERB
     end
 
     module_function :json_escape
+
+    # A utility method for escaping XML names of tags and names of attributes.
+    #
+    #   xml_name_escape('1 < 2 & 3')
+    #   # => "1___2___3"
+    #
+    # It follows the requirements of the specification: https://www.w3.org/TR/REC-xml/#NT-Name
+    def xml_name_escape(name)
+      name = name.to_s
+      return "" if name.blank?
+
+      starting_char = name[0].gsub(TAG_NAME_START_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      return starting_char if name.size == 1
+
+      following_chars = name[1..-1].gsub(TAG_NAME_FOLLOWING_REGEXP, TAG_NAME_REPLACEMENT_CHAR)
+
+      starting_char + following_chars
+    end
+    module_function :xml_name_escape
   end
 end
 

data/lib/active_support/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveSupport
     MAJOR = 7
     MINOR = 0
     TINY  = 2
-    PRE   = "3"
+    PRE   = "4"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 7.0.2.3
+  version: 7.0.2.4
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-08 00:00:00.000000000 Z
+date: 2022-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -359,10 +359,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.2.3/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.2.3/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.2.4/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.2.4/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.2.3/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.2.4/activesupport
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: