activity_notification 2.2.3 → 2.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30c5b3d148d4606e3ebd7c26a14a746180f2ccde5c6197bf28c95aaeceba8d48
-  data.tar.gz: 63454217d875157c64d22dd0e15e947912a73d7f6a1bba371cba05a0973ba680
+  metadata.gz: 86e614046f4d79bd83248b78e66855f7fe8269985676b2afd95389b29e56e25f
+  data.tar.gz: 7a0e82b085c744a2f3197bd530b69b4ed708d93dcaa6f74ad9854afbf5ecc6a2
 SHA512:
-  metadata.gz: 2c7c724cdf1acb560ed8d02c56f80bc5cddee91fc0537779480efae64a40108f14fdcd55850ca121bf766416dad818dc664bdad196c17ef6ebe38d31c18ed2f2
-  data.tar.gz: 604d78217049389797f3508f621b54e0efd0962c075cf8c500d2b957c52e677584f1ec1eeea326bb12570cbe953c02581b248b9dfff54a80328bbf509b9871ee
+  metadata.gz: c0dbbb13396e89d5bbfc8f0fc034fb4c1ad1f02e8ceb8ed1e9b6b8beb8c66e55e72c2e23fcd4383564321992f7fd3fe7f7b6dc3c85ddb338ff7cf43639306f15
+  data.tar.gz: d972a277eabf7256deff36129a8253a423603333deebd96686d7305a9febcb7b19e85f7ea78b48655326899b06aa1535dc85f01bfb6b340df52a56db583f0336

data/.github/workflows/build.yml

@@ -30,27 +30,27 @@ jobs:
         include:
           # https://www.ruby-lang.org/en/downloads
           - gemfile: gemfiles/Gemfile.rails-5.0
-            ruby-version: 2.7.5
+            ruby-version: 2.7.7
           - gemfile: gemfiles/Gemfile.rails-5.1
-            ruby-version: 2.7.5
+            ruby-version: 2.7.7
           - gemfile: gemfiles/Gemfile.rails-5.2
-            ruby-version: 2.7.5
+            ruby-version: 2.7.7
           - gemfile: gemfiles/Gemfile.rails-6.0
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
           - gemfile: gemfiles/Gemfile.rails-6.1
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
           - gemfile: gemfiles/Gemfile.rails-7.0
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
           - gemfile: Gemfile
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
             orm: active_record
             test-db: mysql
           - gemfile: Gemfile
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
             orm: active_record
             test-db: postgresql
           - gemfile: Gemfile
-            ruby-version: 3.0.3
+            ruby-version: 3.2.1
             orm: mongoid
             test-db: mongodb
           - gemfile: Gemfile
@@ -97,7 +97,7 @@ jobs:
           - 27017:27017
         env:
           MONGO_INITDB_DATABASE: activity_notification_test
-        options: --health-cmd mongo --health-interval 10s --health-timeout 5s --health-retries 5
+        options: --health-cmd mongosh --health-interval 10s --health-timeout 5s --health-retries 5
 
     steps:
       - uses: actions/checkout@v2
@@ -106,10 +106,6 @@ jobs:
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
-      - name: Install dependencies
-        run: |
-          bundle install
-          bundle update
       - name: Setup Amazon DynamoDB Local
         if: matrix.orm == 'dynamoid'
         run: |

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2.2.4 / 2023-03-20
+[Full Changelog](http://github.com/simukappu/activity_notification/compare/v2.2.3...v2.2.4)
+
+Bug Fixes:
+
+* Fix broken serialization with Rails security patch - [#166](https://github.com/simukappu/activity_notification/issues/166) [#167](https://github.com/simukappu/activity_notification/pull/167)
+
 ## 2.2.3 / 2022-02-12
 [Full Changelog](http://github.com/simukappu/activity_notification/compare/v2.2.2...v2.2.3)
 

data/Gemfile

@@ -2,13 +2,16 @@ source 'https://rubygems.org'
 
 gemspec
 
-gem 'rails', '~> 6.0.0'
+gem 'rails', '~> 7.0.0'
 
 group :production do
+  gem 'sprockets-rails'
   gem 'puma'
   gem 'pg'
   gem 'devise'
-  gem 'devise_token_auth'
+  # gem 'devise_token_auth'
+  # https://github.com/lynndylanhurley/devise_token_auth/pull/1517
+  gem 'devise_token_auth', git: 'https://github.com/lynndylanhurley/devise_token_auth.git'
 end
 
 group :development do
@@ -20,7 +23,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/docs/Setup.md

@@ -46,6 +46,22 @@ The same can be done for the subscription table name, e.g., if you're using the
 config.subscription_table_name = "notifications_subscriptions"
 ```
 
+If you're redefining `yaml_column_permitted_classes` in *config/application.rb*, then you need to add a few classes to the whitelist to make sure *activity_notification* still works as expected.
+
+```ruby
+config.active_record.yaml_column_permitted_classes ||= []
+
+# your override(s), e.g: MyWhitelistedClass
+config.active_record.yaml_column_permitted_classes << MyWhitelistedClass
+
+# overrides required for activity_notification to work
+config.yaml_column_permitted_classes << ActiveSupport::HashWithIndifferentAccess
+config.yaml_column_permitted_classes << ActiveSupport::TimeWithZone
+config.yaml_column_permitted_classes << ActiveSupport::TimeZone
+config.yaml_column_permitted_classes << Symbol
+config.yaml_column_permitted_classes << Time
+```
+
 #### Using Mongoid ORM
 
 When you use *activity_notification* with [Mongoid](http://mongoid.org) ORM, set **AN_ORM** environment variable to **mongoid**:

data/gemfiles/Gemfile.rails-5.0

@@ -17,7 +17,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/gemfiles/Gemfile.rails-5.1

@@ -16,7 +16,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/gemfiles/Gemfile.rails-5.2

@@ -16,7 +16,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/gemfiles/Gemfile.rails-6.0

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '../'
 
 gem 'rails', '~> 6.0.0'
+gem 'psych', '< 4'
 
 group :development do
   gem 'bullet'
@@ -14,7 +15,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/gemfiles/Gemfile.rails-6.1

@@ -14,7 +14,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/gemfiles/Gemfile.rails-7.0

@@ -3,12 +3,9 @@ source 'https://rubygems.org'
 gemspec path: '../'
 
 gem 'rails', '~> 7.0.0'
+gem 'sprockets-rails'
 # https://github.com/lynndylanhurley/devise_token_auth/pull/1517
 gem 'devise_token_auth', git: 'https://github.com/lynndylanhurley/devise_token_auth.git'
-# https://jira.mongodb.org/browse/MONGOID-5193
-gem 'mongoid', git: 'https://github.com/mongodb/mongoid.git'
-
-gem 'sprockets-rails'
 
 group :development do
   gem 'bullet'
@@ -20,7 +17,7 @@ group :test do
   gem 'ammeter'
   gem 'timecop'
   gem 'committee'
-  gem 'committee-rails'
+  gem 'committee-rails', '< 0.6'
   # gem 'coveralls', require: false
   gem 'coveralls_reborn', require: false
 end

data/lib/activity_notification/models.rb

@@ -17,4 +17,26 @@ module ActivityNotification
   end
 end
 
-ActiveRecord::Base.class_eval { include ActivityNotification::Models } if defined?(ActiveRecord::Base)
+if defined?(ActiveRecord::Base)
+  ActiveRecord::Base.class_eval { include ActivityNotification::Models }
+
+  # https://github.com/simukappu/activity_notification/issues/166
+  # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
+  if (Gem::Version.new("5.2.8.1") <= Rails.gem_version && Rails.gem_version < Gem::Version.new("6.0")) ||
+    (Gem::Version.new("6.0.5.1") <= Rails.gem_version && Rails.gem_version < Gem::Version.new("6.1")) ||
+    (Gem::Version.new("6.1.6.1") <= Rails.gem_version && Rails.gem_version < Gem::Version.new("7.0"))
+    ActiveRecord::Base.yaml_column_permitted_classes ||= []
+    ActiveRecord::Base.yaml_column_permitted_classes << ActiveSupport::HashWithIndifferentAccess
+    ActiveRecord::Base.yaml_column_permitted_classes << ActiveSupport::TimeWithZone
+    ActiveRecord::Base.yaml_column_permitted_classes << ActiveSupport::TimeZone
+    ActiveRecord::Base.yaml_column_permitted_classes << Symbol
+    ActiveRecord::Base.yaml_column_permitted_classes << Time
+  elsif Gem::Version.new("7.0.3.1") <= Rails.gem_version
+    ActiveRecord.yaml_column_permitted_classes ||= []
+    ActiveRecord.yaml_column_permitted_classes << ActiveSupport::HashWithIndifferentAccess
+    ActiveRecord.yaml_column_permitted_classes << ActiveSupport::TimeWithZone
+    ActiveRecord.yaml_column_permitted_classes << ActiveSupport::TimeZone
+    ActiveRecord.yaml_column_permitted_classes << Symbol
+    ActiveRecord.yaml_column_permitted_classes << Time
+  end
+end

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.2.3"
+  VERSION = "2.2.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.2.3
+  version: 2.2.4
 platform: ruby
 authors:
 - Shota Yamazaki
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-12 00:00:00.000000000 Z
+date: 2023-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -683,7 +683,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.2.33
 signing_key:
 specification_version: 4
 summary: Integrated user activity notifications for Ruby on Rails