activesupport 3.1.9 → 3.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 !binary "U0hBMQ==":
-  metadata.gz: d2385b169328eee891ecb00a1751e9e11036b2c7
-  data.tar.gz: a60756f13eb74290cece0c1d180fa7139f5cc6b1
+  metadata.gz: dfe441c4607cf0124b6907a018677eabf8f7da0e
+  data.tar.gz: fa5d6c4679fa80e414d424061d71e6ba5a4e23a3
 !binary "U0hBNTEy":
-  metadata.gz: 6ceca258031c6dcbd84b17ccda7ebbacad9ee0894c89db7d37038e92b62468e5a9fc738147b9f9b0d5a735e4ad6ef27c0c2fbb78e9fe1028a7ce51fdd26d057d
-  data.tar.gz: f68accb26b810a194bd11ed6c990bb03b0619c802dd2459c3f88229526d32becd193891d800dc4162b9edde39817d7ef2e204aa13b50ff1727dbcf81d6a4cf48
+  metadata.gz: c23a883d0813511ede2b93c40dd887ae49366f3f9654ff6a98b33a914a23e62b2f84e485437afdf79c475ee3c5f125d777c83f4f4b83b00232e930fb6d981ce5
+  data.tar.gz: 24e6ce2cd809ac20552a548d88ec3d4f921128cb457415474824e6cdebeb666818fe55114a98cd486e24e00bfebac895b46096bafa55d8270b2d58c03b8b72f9

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 3.1.10 (Jan 8, 2012) ##
+
+*   Hash.from_xml raises when it encounters type="symbol" or type="yaml".
+    Use Hash.from_trusted_xml to parse this XML.
+
+    CVE-2013-0156
+
+    *Jeremy Kemper*
+
 ## Rails 3.1.9
 
 ## Rails 3.1.8 (Aug 9, 2012)

data/lib/active_support/core_ext/hash/conversions.rb

@@ -85,15 +85,33 @@ class Hash
     end
   end
 
+  class DisallowedType < StandardError #:nodoc:
+    def initialize(type)
+      super "Disallowed type attribute: #{type.inspect}"
+    end
+  end
+
+  DISALLOWED_XML_TYPES = %w(symbol yaml)
+
   class << self
-    def from_xml(xml)
-      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)))
+    def from_xml(xml, disallowed_types = nil)
+      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)), disallowed_types)
+    end
+
+    def from_trusted_xml(xml)
+      from_xml xml, []
     end
 
     private
-      def typecast_xml_value(value)
+      def typecast_xml_value(value, disallowed_types = nil)
+        disallowed_types ||= DISALLOWED_XML_TYPES
+
         case value.class.to_s
           when 'Hash'
+            if value.include?('type') && !value['type'].is_a?(Hash) && disallowed_types.include?(value['type'])
+              raise DisallowedType, value['type']
+            end
+
             if value['type'] == 'array'
               _, entries = Array.wrap(value.detect { |k,v| not v.is_a?(String) })
               if entries.nil? || (c = value['__content__'] && c.blank?)
@@ -101,9 +119,9 @@ class Hash
               else
                 case entries.class.to_s   # something weird with classes not matching here.  maybe singleton methods breaking is_a?
                 when "Array"
-                  entries.collect { |v| typecast_xml_value(v) }
+                  entries.collect { |v| typecast_xml_value(v, disallowed_types) }
                 when "Hash"
-                  [typecast_xml_value(entries)]
+                  [typecast_xml_value(entries, disallowed_types)]
                 else
                   raise "can't typecast #{entries.inspect}"
                 end
@@ -127,14 +145,14 @@ class Hash
             elsif value['type'] && value.size == 1 && !value['type'].is_a?(::Hash)
               nil
             else
-              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v)] }]
+              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v, disallowed_types)] }]
 
               # Turn { :files => { :file => #<StringIO> } into { :files => #<StringIO> } so it is compatible with
               # how multipart uploaded files from HTML appear
               xml_value["file"].is_a?(StringIO) ? xml_value["file"] : xml_value
             end
           when 'Array'
-            value.map! { |i| typecast_xml_value(i) }
+            value.map! { |i| typecast_xml_value(i, disallowed_types) }
             value.length > 1 ? value : value.first
           when 'String'
             value

data/lib/active_support/version.rb

@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 1
-    TINY  = 9
+    TINY  = 10
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 3.1.9
+  version: 3.1.10
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-23 00:00:00.000000000 Z
+date: 2013-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
@@ -273,7 +273,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0.preview2.1
+rubygems_version: 2.0.0.preview3
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the