activesupport 3.2.21 → 3.2.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6bded9f02fdf2d36d822eaa68d5839ee205f58e4
-  data.tar.gz: c768383acc14b5120dc72a3376789f3ceb419e44
+  metadata.gz: a9430f2c7b260f6a3e92fcb72a6bc1f24e4e05e6
+  data.tar.gz: 91faa7710848ad3250e152c3964d67ff59cababe
 SHA512:
-  metadata.gz: 53d762c61f5d9ac5d938d75a210e24007fa237d83c248331b01b6dbf64f4c837472dd747a410beb42f90d8666cbe438ab5fd7b8e4ea10ef65f15b61d7a90c6e1
-  data.tar.gz: 077ad916fffe16fc20b74590b7760f44eea2488cfae84ca9530b6013cc3214c7446f9cfa5f1ec1ea6d2999a5bc22a66110cc56f359d579806e2a904cac9669cb
+  metadata.gz: e686c722964e68bb04fc372ec3759089d1fd82dc8193a18aae6c71b9bb5901f0d27bd46e1a69980b9a6fe5b464d6627b37cbd1708ff58ba0b11550d3ddb31470
+  data.tar.gz: 37129f462c828e4fb7a887c1a30368601c3340028255f6366a51f7de1ec06dbcf67d637aa8cb0f0fe50d472a3cc6b6c768bcd24d4be648496ba27a4020bd3106

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 3.2.22 (Jun 16, 2015) ##
+
+*   Fix denial of service vulnerability in the XML processing.
+
+    CVE-2015-3227.
+
+    *Aaron Patterson*
+
+
 ## Rails 3.2.19 (Jul 2, 2014) ##
 
 *   Make sure Active Support configurations are applied correctly.

data/lib/active_support/core_ext/big_decimal/conversions.rb

@@ -16,7 +16,9 @@ class BigDecimal
   #
   # Note that reconstituting YAML floats to native floats may lose precision.
   def to_yaml(opts = {})
-    return super if defined?(YAML::ENGINE) && !YAML::ENGINE.syck?
+    return super if
+      (defined?(YAML::ENGINE) && !YAML::ENGINE.syck?) ||
+      (defined?(Psych) && YAML == Psych)
 
     YAML.quick_emit(nil, opts) do |out|
       string = to_s

data/lib/active_support/core_ext/class/attribute.rb

@@ -109,7 +109,9 @@ class Class
   end
 
   private
-  def singleton_class?
-    ancestors.first != self
-  end
+    unless respond_to?(:singleton_class?)
+      def singleton_class?
+        ancestors.first != self
+      end
+    end
 end

data/lib/active_support/core_ext/date_time/calculations.rb

@@ -138,6 +138,12 @@ class DateTime
 
   # Layers additional behavior on DateTime#<=> so that Time and ActiveSupport::TimeWithZone instances can be compared with a DateTime
   def <=>(other)
-    super other.kind_of?(Infinity) ? other : other.to_datetime
+    if other.kind_of?(Infinity)
+      super
+    elsif other.respond_to? :to_datetime
+      super other.to_datetime
+    else
+      nil
+    end
   end
 end

data/lib/active_support/test_case.rb

@@ -1,4 +1,8 @@
-require 'test/unit/testcase'
+begin
+  require 'test/unit/testcase'
+rescue LoadError => e
+  raise LoadError, "Please add test-unit gem to your Gemfile: `gem 'test-unit', '~> 3.0'` (#{e.message})", e.backtrace
+end
 require 'active_support/testing/setup_and_teardown'
 require 'active_support/testing/assertions'
 require 'active_support/testing/deprecation'

data/lib/active_support/testing/isolation.rb

@@ -156,7 +156,12 @@ end
 
 # Only in subprocess for windows / jruby.
 if ENV['ISOLATION_TEST']
-  require "test/unit/collector/objectspace"
+  begin
+    require "test/unit/collector/objectspace"
+  rescue LoadError => e
+    raise LoadError, "Please add test-unit gem to your Gemfile: `gem 'test-unit', '~> 3.0'` (#{e.message})", e.backtrace
+  end
+
   class Test::Unit::Collector::ObjectSpace
     def include?(test)
       super && test.method_name == ENV['ISOLATION_TEST']

data/lib/active_support/values/time_zone.rb

@@ -223,6 +223,7 @@ module ActiveSupport
     # Compare this time zone to the parameter. The two are compared first on
     # their offsets, and then by name.
     def <=>(zone)
+      return unless zone.respond_to?(:utc_offset) && zone.respond_to?(:name)
       result = (utc_offset <=> zone.utc_offset)
       result = (name <=> zone.name) if result == 0
       result
@@ -267,7 +268,7 @@ module ActiveSupport
     #
     #   Time.zone.now                 # => Fri, 31 Dec 1999 14:00:00 HST -10:00
     #   Time.zone.parse('22:30:00')   # => Fri, 31 Dec 1999 22:30:00 HST -10:00
-    def parse(str, now=now)
+    def parse(str, now=self.now)
       parts = Date._parse(str, false)
       return if parts.empty?
 

data/lib/active_support/version.rb

@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 21
+    TINY  = 22
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

data/lib/active_support/xml_mini.rb

@@ -77,6 +77,9 @@ module ActiveSupport
     end
 
     attr_reader :backend
+    attr_accessor :depth
+    self.depth = 100
+
     delegate :parse, :to => :backend
 
     def backend=(name)

data/lib/active_support/xml_mini/jdom.rb

@@ -47,7 +47,7 @@ module ActiveSupport
         xml_string_reader = StringReader.new(data)
         xml_input_source = InputSource.new(xml_string_reader)
         doc = @dbf.new_document_builder.parse(xml_input_source)
-        merge_element!({CONTENT_KEY => ''}, doc.document_element)
+        merge_element!({CONTENT_KEY => ''}, doc.document_element, XmlMini.depth)
       end
     end
 
@@ -59,9 +59,10 @@ module ActiveSupport
     #   Hash to merge the converted element into.
     # element::
     #   XML element to merge into hash
-    def merge_element!(hash, element)
+    def merge_element!(hash, element, depth)
+      raise 'Document too deep!' if depth == 0
       delete_empty(hash)
-      merge!(hash, element.tag_name, collapse(element))
+      merge!(hash, element.tag_name, collapse(element, depth))
     end
 
     def delete_empty(hash)
@@ -72,14 +73,14 @@ module ActiveSupport
     #
     # element::
     #   The document element to be collapsed.
-    def collapse(element)
+    def collapse(element, depth)
       hash = get_attributes(element)
 
       child_nodes = element.child_nodes
       if child_nodes.length > 0
         for i in 0...child_nodes.length
           child = child_nodes.item(i)
-          merge_element!(hash, child) unless child.node_type == Node.TEXT_NODE
+          merge_element!(hash, child, depth - 1) unless child.node_type == Node.TEXT_NODE
         end
         merge_texts!(hash, element) unless empty_content?(element)
         hash

data/lib/active_support/xml_mini/rexml.rb

@@ -30,7 +30,7 @@ module ActiveSupport
         doc = REXML::Document.new(data)
 
         if doc.root
-          merge_element!({}, doc.root)
+          merge_element!({}, doc.root, XmlMini.depth)
         else
           raise REXML::ParseException,
             "The document #{doc.to_s.inspect} does not have a valid root"
@@ -45,19 +45,20 @@ module ActiveSupport
       #   Hash to merge the converted element into.
       # element::
       #   XML element to merge into hash
-      def merge_element!(hash, element)
-        merge!(hash, element.name, collapse(element))
+      def merge_element!(hash, element, depth)
+        raise REXML::ParseException, "The document is too deep" if depth == 0
+        merge!(hash, element.name, collapse(element, depth))
       end
 
       # Actually converts an XML document element into a data structure.
       #
       # element::
       #   The document element to be collapsed.
-      def collapse(element)
+      def collapse(element, depth)
         hash = get_attributes(element)
 
         if element.has_elements?
-          element.each_element {|child| merge_element!(hash, child) }
+          element.each_element {|child| merge_element!(hash, child, depth - 1) }
           merge_texts!(hash, element) unless empty_content?(element)
           hash
         else

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 3.2.21
+  version: 3.2.22
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-16 00:00:00.000000000 Z
+date: 2015-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n
@@ -287,7 +287,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.2
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the