activesupport 3.2.10 → 3.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 !binary "U0hBMQ==":
-  metadata.gz: 9ebbf393801a3ebd00f9a8d31f0888929486e86e
-  data.tar.gz: 039464479406858f262d1da2e9edb2c5f65bee2a
+  metadata.gz: 9f107489d40d530bb99b4b0d56e787b7455544e6
+  data.tar.gz: 44e39249e6b793dac59f702d5583c5d5634e776d
 !binary "U0hBNTEy":
-  metadata.gz: fca30fb81575567ed505cb09c1611e2cd73a9242513df756edfd69365e5e46ac7b3fc924163bb34989fef2ef3b66288c92c564532773d6d66c9b75be518d48f7
-  data.tar.gz: d83e259835c2bf05892ac0f3349e088a2b4371a81d7cc2951baf40cfceace53384b9377a77aff6a28dd7d4b58c08a0458d7f4efc8d065143ba499bce60cefd2b
+  metadata.gz: 6e56157585db548253e82a8897ce7357e86952f083e8f7da01affb52dc6117b3db1ff07b916c22d0b244b9a315a2821913c20f095e5b39a81665fc297c8f1106
+  data.tar.gz: 99c5bd237aa7881a077658c0e70960fab81b221eb1bb28c208215be19d7518e8f56a54cfba3299ec2e3fdbb185722c4c5e5821b72160ae2b1cbd8e04725fd315

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 3.2.10 (Jan 8, 2012) ##
+
+*   Hash.from_xml raises when it encounters type="symbol" or type="yaml".
+    Use Hash.from_trusted_xml to parse this XML.
+
+    CVE-2013-0156
+
+    *Jeremy Kemper*
+
 ## Rails 3.2.9 (Nov 12, 2012) ##
 
 *   Add logger.push_tags and .pop_tags to complement logger.tagged:

data/lib/active_support/core_ext/hash/conversions.rb

@@ -85,15 +85,33 @@ class Hash
     end
   end
 
+  class DisallowedType < StandardError #:nodoc:
+    def initialize(type)
+      super "Disallowed type attribute: #{type.inspect}"
+    end
+  end
+
+  DISALLOWED_XML_TYPES = %w(symbol yaml)
+
   class << self
-    def from_xml(xml)
-      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)))
+    def from_xml(xml, disallowed_types = nil)
+      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)), disallowed_types)
+    end
+
+    def from_trusted_xml(xml)
+      from_xml xml, []
     end
 
     private
-      def typecast_xml_value(value)
+      def typecast_xml_value(value, disallowed_types = nil)
+        disallowed_types ||= DISALLOWED_XML_TYPES
+
         case value.class.to_s
           when 'Hash'
+            if value.include?('type') && !value['type'].is_a?(Hash) && disallowed_types.include?(value['type'])
+              raise DisallowedType, value['type']
+            end
+
             if value['type'] == 'array'
               _, entries = Array.wrap(value.detect { |k,v| not v.is_a?(String) })
               if entries.nil? || (c = value['__content__'] && c.blank?)
@@ -101,9 +119,9 @@ class Hash
               else
                 case entries.class.to_s   # something weird with classes not matching here.  maybe singleton methods breaking is_a?
                 when "Array"
-                  entries.collect { |v| typecast_xml_value(v) }
+                  entries.collect { |v| typecast_xml_value(v, disallowed_types) }
                 when "Hash"
-                  [typecast_xml_value(entries)]
+                  [typecast_xml_value(entries, disallowed_types)]
                 else
                   raise "can't typecast #{entries.inspect}"
                 end
@@ -127,14 +145,14 @@ class Hash
             elsif value['type'] && value.size == 1 && !value['type'].is_a?(::Hash)
               nil
             else
-              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v)] }]
+              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v, disallowed_types)] }]
 
               # Turn { :files => { :file => #<StringIO> } into { :files => #<StringIO> } so it is compatible with
               # how multipart uploaded files from HTML appear
               xml_value["file"].is_a?(StringIO) ? xml_value["file"] : xml_value
             end
           when 'Array'
-            value.map! { |i| typecast_xml_value(i) }
+            value.map! { |i| typecast_xml_value(i, disallowed_types) }
             value.length > 1 ? value : value.first
           when 'String'
             value

data/lib/active_support/version.rb

@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 10
+    TINY  = 11
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 3.2.10
+  version: 3.2.11
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-23 00:00:00.000000000 Z
+date: 2013-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -280,7 +280,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0.preview2.1
+rubygems_version: 2.0.0.preview3
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the