activesupport 3.0.18 → 3.0.19

checksums.yaml

@@ -0,0 +1,7 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: 6cb3ad3c0372d8514caee7e2d5217d2be827a88f
+  data.tar.gz: 50718fbe4e4d817a3cb79708e32e08a8e465a2d9
+!binary "U0hBNTEy":
+  metadata.gz: acd964ef057809cb947c30db00cc34d4a8eadb32ef3e80f33199fe76287bda8fbb53dddf004718d41eea99ac6bde63fe730561f98e401b0c8ec11b2e20be37c1
+  data.tar.gz: 02b7c6804a3844706f83e66dc0325098cf2e4576fa485e64468eaaba60b7f559d33f61bccf0a2f371ad6b14a3515a5b2689904e9b9864cb21d5c169e83e6adba

data/CHANGELOG

@@ -1,3 +1,12 @@
+## Rails 3.0.19 (Jan 8, 2012) ##
+
+*   Hash.from_xml raises when it encounters type="symbol" or type="yaml".
+    Use Hash.from_trusted_xml to parse this XML.
+
+    CVE-2013-0156
+
+    *Jeremy Kemper*
+
 ## Rails 3.0.18
 
 ## Rails 3.0.17 (Aug 9, 2012)

data/lib/active_support/core_ext/hash/conversions.rb

@@ -73,15 +73,33 @@ class Hash
     end
   end
 
+  class DisallowedType < StandardError #:nodoc:
+    def initialize(type)
+      super "Disallowed type attribute: #{type.inspect}"
+    end
+  end
+
+  DISALLOWED_XML_TYPES = %w(symbol yaml)
+
   class << self
-    def from_xml(xml)
-      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)))
+    def from_xml(xml, disallowed_types = nil)
+      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)), disallowed_types)
+    end
+
+    def from_trusted_xml(xml)
+      from_xml xml, []
     end
 
     private
-      def typecast_xml_value(value)
+      def typecast_xml_value(value, disallowed_types = nil)
+        disallowed_types ||= DISALLOWED_XML_TYPES
+
         case value.class.to_s
           when 'Hash'
+            if value.include?('type') && !value['type'].is_a?(Hash) && disallowed_types.include?(value['type'])
+              raise DisallowedType, value['type']
+            end
+
             if value['type'] == 'array'
               _, entries = Array.wrap(value.detect { |k,v| k != 'type' })
               if entries.nil? || (c = value['__content__'] && c.blank?)
@@ -89,9 +107,9 @@ class Hash
               else
                 case entries.class.to_s   # something weird with classes not matching here.  maybe singleton methods breaking is_a?
                 when "Array"
-                  entries.collect { |v| typecast_xml_value(v) }
+                  entries.collect { |v| typecast_xml_value(v, disallowed_types) }
                 when "Hash"
-                  [typecast_xml_value(entries)]
+                  [typecast_xml_value(entries, disallowed_types)]
                 else
                   raise "can't typecast #{entries.inspect}"
                 end
@@ -116,7 +134,7 @@ class Hash
               nil
             else
               xml_value = value.inject({}) do |h,(k,v)|
-                h[k] = typecast_xml_value(v)
+                h[k] = typecast_xml_value(v, disallowed_types)
                 h
               end
 
@@ -125,7 +143,7 @@ class Hash
               xml_value["file"].is_a?(StringIO) ? xml_value["file"] : xml_value
             end
           when 'Array'
-            value.map! { |i| typecast_xml_value(i) }
+            value.map! { |i| typecast_xml_value(i, disallowed_types) }
             value.length > 1 ? value : value.first
           when 'String'
             value

data/lib/active_support/version.rb

@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 0
-    TINY  = 18
+    TINY  = 19
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 3.0.18
-  prerelease: 
+  version: 3.0.19
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-23 00:00:00.000000000 Z
+date: 2013-01-08 00:00:00.000000000 Z
 dependencies: []
 description: A toolkit of support libraries and Ruby core extensions extracted from
   the Rails framework. Rich support for multibyte strings, internationalization, time
@@ -230,30 +229,26 @@ files:
 - lib/active_support.rb
 homepage: http://www.rubyonrails.org
 licenses: []
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 1.8.7
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
-      segments:
-      - 0
-      hash: -2978729202858728316
 requirements: []
 rubyforge_project: activesupport
-rubygems_version: 1.8.24
+rubygems_version: 2.0.0.preview3
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.
 test_files: []