bundler-audit 0.7.0.1 → 0.9.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (612) hide show
  1. checksums.yaml +4 -4
  2. data/.github/FUNDING.yml +3 -0
  3. data/.github/ISSUE_TEMPLATE/bug-report.md +44 -0
  4. data/.github/workflows/ruby.yml +41 -0
  5. data/.gitignore +1 -0
  6. data/.rspec +1 -1
  7. data/.rubocop.yml +83 -0
  8. data/COPYING.txt +4 -4
  9. data/ChangeLog.md +90 -4
  10. data/Gemfile +7 -3
  11. data/README.md +77 -17
  12. data/Rakefile +7 -26
  13. data/bundler-audit.gemspec +3 -11
  14. data/gemspec.yml +2 -2
  15. data/lib/bundler/audit/advisory.rb +31 -4
  16. data/lib/bundler/audit/cli/formats/json.rb +65 -0
  17. data/lib/bundler/audit/cli/formats/junit.rb +127 -0
  18. data/lib/bundler/audit/cli/formats/text.rb +122 -0
  19. data/lib/bundler/audit/cli/formats.rb +148 -0
  20. data/lib/bundler/audit/cli/thor_ext/shell/basic/say_error.rb +33 -0
  21. data/lib/bundler/audit/cli.rb +111 -93
  22. data/lib/bundler/audit/configuration.rb +108 -0
  23. data/lib/bundler/audit/database.rb +153 -30
  24. data/lib/bundler/audit/report.rb +149 -0
  25. data/lib/bundler/audit/results/insecure_source.rb +78 -0
  26. data/lib/bundler/audit/results/result.rb +21 -0
  27. data/lib/bundler/audit/results/unpatched_gem.rb +98 -0
  28. data/lib/bundler/audit/results.rb +19 -0
  29. data/lib/bundler/audit/scanner.rb +101 -22
  30. data/lib/bundler/audit/task.rb +19 -6
  31. data/lib/bundler/audit/version.rb +3 -3
  32. data/lib/bundler/audit.rb +2 -2
  33. data/spec/advisory_spec.rb +42 -15
  34. data/spec/bundle/insecure_sources/Gemfile.lock +133 -85
  35. data/spec/bundle/secure/Gemfile.lock +60 -57
  36. data/spec/bundle/unpatched_gems/Gemfile.lock +6 -72
  37. data/spec/bundle/unpatched_gems_with_dot_configuration/.bundler-audit.yml +3 -0
  38. data/spec/bundle/unpatched_gems_with_dot_configuration/Gemfile +3 -0
  39. data/spec/bundle/unpatched_gems_with_dot_configuration/Gemfile.lock +31 -0
  40. data/spec/cli/formats/json_spec.rb +114 -0
  41. data/spec/cli/formats/junit_spec.rb +284 -0
  42. data/spec/cli/formats/text_spec.rb +273 -0
  43. data/spec/cli/formats_spec.rb +86 -0
  44. data/spec/cli_spec.rb +78 -26
  45. data/spec/configuration_spec.rb +78 -0
  46. data/spec/database_spec.rb +273 -52
  47. data/spec/fixtures/advisory/CVE-2020-1234.yml +21 -0
  48. data/spec/fixtures/{not_a_hash.yml → advisory/not_a_hash.yml} +0 -0
  49. data/spec/fixtures/config/bad/empty.yml +0 -0
  50. data/spec/fixtures/config/bad/ignore_contains_a_non_string.yml +4 -0
  51. data/spec/fixtures/config/bad/ignore_is_not_an_array.yml +3 -0
  52. data/spec/fixtures/config/valid.yml +4 -0
  53. data/spec/fixtures/lib/bundler/audit/cli/formats/bad.rb +17 -0
  54. data/spec/fixtures/lib/bundler/audit/cli/formats/good.rb +17 -0
  55. data/spec/integration_spec.rb +17 -89
  56. data/spec/report_spec.rb +98 -0
  57. data/spec/results/insecure_source_spec.rb +47 -0
  58. data/spec/results/result_spec.rb +10 -0
  59. data/spec/results/unpatched_gem_spec.rb +123 -0
  60. data/spec/scanner_spec.rb +90 -35
  61. data/spec/spec_helper.rb +42 -25
  62. metadata +46 -568
  63. data/.gitmodules +0 -3
  64. data/.travis.yml +0 -14
  65. data/data/ruby-advisory-db/.gitignore +0 -1
  66. data/data/ruby-advisory-db/.rspec +0 -1
  67. data/data/ruby-advisory-db/.travis.yml +0 -12
  68. data/data/ruby-advisory-db/CONTRIBUTING.md +0 -71
  69. data/data/ruby-advisory-db/CONTRIBUTORS.md +0 -41
  70. data/data/ruby-advisory-db/Gemfile +0 -11
  71. data/data/ruby-advisory-db/Gemfile.lock +0 -44
  72. data/data/ruby-advisory-db/LICENSE.txt +0 -5
  73. data/data/ruby-advisory-db/README.md +0 -133
  74. data/data/ruby-advisory-db/Rakefile +0 -22
  75. data/data/ruby-advisory-db/gems/Arabic-Prawn/CVE-2014-2322.yml +0 -12
  76. data/data/ruby-advisory-db/gems/RedCloth/CVE-2012-6684.yml +0 -21
  77. data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4995.yml +0 -13
  78. data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4996.yml +0 -13
  79. data/data/ruby-advisory-db/gems/actionmailer/CVE-2013-4389.yml +0 -17
  80. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-1099.yml +0 -26
  81. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3424.yml +0 -28
  82. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3463.yml +0 -26
  83. data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3465.yml +0 -23
  84. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-0156.yml +0 -24
  85. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1855.yml +0 -20
  86. data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1857.yml +0 -23
  87. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0081.yml +0 -24
  88. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0082.yml +0 -22
  89. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0130.yml +0 -23
  90. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7818.yml +0 -24
  91. data/data/ruby-advisory-db/gems/actionpack/CVE-2014-7829.yml +0 -26
  92. data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7576.yml +0 -119
  93. data/data/ruby-advisory-db/gems/actionpack/CVE-2015-7581.yml +0 -55
  94. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0751.yml +0 -74
  95. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-0752.yml +0 -96
  96. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2097.yml +0 -91
  97. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-2098.yml +0 -89
  98. data/data/ruby-advisory-db/gems/actionpack/CVE-2016-6316.yml +0 -57
  99. data/data/ruby-advisory-db/gems/actionpack/CVE-2020-8164.yml +0 -49
  100. data/data/ruby-advisory-db/gems/actionpack/CVE-2020-8166.yml +0 -31
  101. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100524.yml +0 -20
  102. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100525.yml +0 -21
  103. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100526.yml +0 -27
  104. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100527.yml +0 -24
  105. data/data/ruby-advisory-db/gems/actionpack/OSVDB-100528.yml +0 -22
  106. data/data/ruby-advisory-db/gems/actionpack/OSVDB-74616.yml +0 -18
  107. data/data/ruby-advisory-db/gems/actionpack/OSVDB-77199.yml +0 -23
  108. data/data/ruby-advisory-db/gems/actionpack-page_caching/CVE-2020-8159.yml +0 -40
  109. data/data/ruby-advisory-db/gems/actionview/CVE-2016-0752.yml +0 -95
  110. data/data/ruby-advisory-db/gems/actionview/CVE-2016-2097.yml +0 -89
  111. data/data/ruby-advisory-db/gems/actionview/CVE-2016-6316.yml +0 -56
  112. data/data/ruby-advisory-db/gems/actionview/CVE-2019-5418.yml +0 -98
  113. data/data/ruby-advisory-db/gems/actionview/CVE-2019-5419.yml +0 -95
  114. data/data/ruby-advisory-db/gems/actionview/CVE-2020-5267.yml +0 -69
  115. data/data/ruby-advisory-db/gems/actionview/CVE-2020-8163.yml +0 -29
  116. data/data/ruby-advisory-db/gems/actionview/CVE-2020-8167.yml +0 -45
  117. data/data/ruby-advisory-db/gems/active-support/CVE-2018-3779.yml +0 -17
  118. data/data/ruby-advisory-db/gems/activejob/CVE-2018-16476.yml +0 -36
  119. data/data/ruby-advisory-db/gems/activemodel/CVE-2016-0753.yml +0 -95
  120. data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2660.yml +0 -24
  121. data/data/ruby-advisory-db/gems/activerecord/CVE-2012-2661.yml +0 -25
  122. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0155.yml +0 -24
  123. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0276.yml +0 -21
  124. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-0277.yml +0 -23
  125. data/data/ruby-advisory-db/gems/activerecord/CVE-2013-1854.yml +0 -26
  126. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-0080.yml +0 -23
  127. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3482.yml +0 -23
  128. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3483.yml +0 -24
  129. data/data/ruby-advisory-db/gems/activerecord/CVE-2014-3514.yml +0 -23
  130. data/data/ruby-advisory-db/gems/activerecord/CVE-2015-7577.yml +0 -110
  131. data/data/ruby-advisory-db/gems/activerecord/CVE-2016-6317.yml +0 -73
  132. data/data/ruby-advisory-db/gems/activerecord/OSVDB-88661.yml +0 -20
  133. data/data/ruby-advisory-db/gems/activerecord-jdbc-adapter/OSVDB-114854.yml +0 -20
  134. data/data/ruby-advisory-db/gems/activerecord-oracle_enhanced-adapter/OSVDB-95376.yml +0 -15
  135. data/data/ruby-advisory-db/gems/activeresource/CVE-2020-8151.yml +0 -48
  136. data/data/ruby-advisory-db/gems/activeresource/OSVDB-95749.yml +0 -15
  137. data/data/ruby-advisory-db/gems/activestorage/CVE-2018-16477.yml +0 -43
  138. data/data/ruby-advisory-db/gems/activestorage/CVE-2020-8162.yml +0 -31
  139. data/data/ruby-advisory-db/gems/activesupport/CVE-2012-1098.yml +0 -26
  140. data/data/ruby-advisory-db/gems/activesupport/CVE-2012-3464.yml +0 -23
  141. data/data/ruby-advisory-db/gems/activesupport/CVE-2013-0333.yml +0 -25
  142. data/data/ruby-advisory-db/gems/activesupport/CVE-2013-1856.yml +0 -28
  143. data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3226.yml +0 -55
  144. data/data/ruby-advisory-db/gems/activesupport/CVE-2015-3227.yml +0 -33
  145. data/data/ruby-advisory-db/gems/activesupport/CVE-2020-8165.yml +0 -41
  146. data/data/ruby-advisory-db/gems/administrate/CVE-2016-3098.yml +0 -14
  147. data/data/ruby-advisory-db/gems/administrate/CVE-2020-5257.yml +0 -24
  148. data/data/ruby-advisory-db/gems/aescrypt/CVE-2013-7463.yml +0 -10
  149. data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml +0 -18
  150. data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml +0 -16
  151. data/data/ruby-advisory-db/gems/as/OSVDB-112683.yml +0 -10
  152. data/data/ruby-advisory-db/gems/authlogic/CVE-2012-6497.yml +0 -15
  153. data/data/ruby-advisory-db/gems/auto_awesomplete/OSVDB-132800.yml +0 -11
  154. data/data/ruby-advisory-db/gems/auto_select2/OSVDB-132800.yml +0 -13
  155. data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml +0 -19
  156. data/data/ruby-advisory-db/gems/awesome_spawn/CVE-2014-0156.yml +0 -19
  157. data/data/ruby-advisory-db/gems/backup-agoddard/CVE-2014-4993.yml +0 -8
  158. data/data/ruby-advisory-db/gems/backup_checksum/CVE-2014-4993.yml +0 -12
  159. data/data/ruby-advisory-db/gems/backup_checksum/OSVDB-108570.yml +0 -10
  160. data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml +0 -17
  161. data/data/ruby-advisory-db/gems/bcrypt-ruby/OSVDB-62067.yml +0 -19
  162. data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml +0 -16
  163. data/data/ruby-advisory-db/gems/bio-basespace-sdk/CVE-2013-7111.yml +0 -8
  164. data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml +0 -18
  165. data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml +0 -19
  166. data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml +0 -20
  167. data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml +0 -24
  168. data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml +0 -20
  169. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml +0 -20
  170. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml +0 -25
  171. data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml +0 -20
  172. data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml +0 -26
  173. data/data/ruby-advisory-db/gems/brbackup/CVE-2014-5004.yml +0 -11
  174. data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml +0 -12
  175. data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml +0 -11
  176. data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml +0 -21
  177. data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml +0 -18
  178. data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml +0 -13
  179. data/data/ruby-advisory-db/gems/bundler/CVE-2013-0334.yml +0 -15
  180. data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml +0 -13
  181. data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml +0 -12
  182. data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml +0 -12
  183. data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml +0 -15
  184. data/data/ruby-advisory-db/gems/cap-strap/CVE-2014-4992.yml +0 -8
  185. data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml +0 -7
  186. data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml +0 -19
  187. data/data/ruby-advisory-db/gems/chartkick/CVE-2019-12732.yml +0 -21
  188. data/data/ruby-advisory-db/gems/chartkick/CVE-2019-18841.yml +0 -13
  189. data/data/ruby-advisory-db/gems/chloride/CVE-2018-6517.yml +0 -17
  190. data/data/ruby-advisory-db/gems/ciborg/CVE-2014-5003.yml +0 -8
  191. data/data/ruby-advisory-db/gems/cocaine/CVE-2013-4457.yml +0 -15
  192. data/data/ruby-advisory-db/gems/codders-dataset/CVE-2014-4991.yml +0 -8
  193. data/data/ruby-advisory-db/gems/coin_base/CVE-2019-15224.yml +0 -18
  194. data/data/ruby-advisory-db/gems/colorscore/CVE-2015-7541.yml +0 -21
  195. data/data/ruby-advisory-db/gems/coming-soon/CVE-2019-15224.yml +0 -18
  196. data/data/ruby-advisory-db/gems/command_wrap/CVE-2013-1875.yml +0 -9
  197. data/data/ruby-advisory-db/gems/consul/CVE-2019-16377.yml +0 -15
  198. data/data/ruby-advisory-db/gems/crack/CVE-2013-1800.yml +0 -17
  199. data/data/ruby-advisory-db/gems/cremefraiche/CVE-2013-2090.yml +0 -11
  200. data/data/ruby-advisory-db/gems/cron_parser/CVE-2019-15224.yml +0 -20
  201. data/data/ruby-advisory-db/gems/curb/OSVDB-114600.yml +0 -12
  202. data/data/ruby-advisory-db/gems/curl/CVE-2013-2617.yml +0 -13
  203. data/data/ruby-advisory-db/gems/datagrid/CVE-2019-14281.yml +0 -14
  204. data/data/ruby-advisory-db/gems/delayed_job_web/CVE-2017-12097.yml +0 -17
  205. data/data/ruby-advisory-db/gems/devise/CVE-2013-0233.yml +0 -20
  206. data/data/ruby-advisory-db/gems/devise/CVE-2015-8314.yml +0 -14
  207. data/data/ruby-advisory-db/gems/devise/CVE-2019-16109.yml +0 -13
  208. data/data/ruby-advisory-db/gems/devise/CVE-2019-5421.yml +0 -16
  209. data/data/ruby-advisory-db/gems/devise/OSVDB-114435.yml +0 -17
  210. data/data/ruby-advisory-db/gems/devise-two-factor/CVE-2015-7225.yml +0 -22
  211. data/data/ruby-advisory-db/gems/doge-coin/CVE-2019-15224.yml +0 -19
  212. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2014-8144.yml +0 -26
  213. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2016-6582.yml +0 -43
  214. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000088.yml +0 -39
  215. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2018-1000211.yml +0 -39
  216. data/data/ruby-advisory-db/gems/doorkeeper/CVE-2020-10187.yml +0 -34
  217. data/data/ruby-advisory-db/gems/doorkeeper/OSVDB-118830.yml +0 -17
  218. data/data/ruby-advisory-db/gems/doorkeeper-openid_connect/CVE-2019-9837.yml +0 -16
  219. data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-1756.yml +0 -16
  220. data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-5671.yml +0 -14
  221. data/data/ruby-advisory-db/gems/dragonfly/OSVDB-110439.yml +0 -13
  222. data/data/ruby-advisory-db/gems/dragonfly/OSVDB-97854.yml +0 -12
  223. data/data/ruby-advisory-db/gems/easymon/CVE-2018-1000855.yml +0 -16
  224. data/data/ruby-advisory-db/gems/echor/CVE-2014-1834.yml +0 -12
  225. data/data/ruby-advisory-db/gems/echor/CVE-2014-1835.yml +0 -11
  226. data/data/ruby-advisory-db/gems/ember-source/CVE-2013-4170.yml +0 -25
  227. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0013.yml +0 -33
  228. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0014.yml +0 -30
  229. data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0046.yml +0 -26
  230. data/data/ruby-advisory-db/gems/ember-source/CVE-2015-1866.yml +0 -26
  231. data/data/ruby-advisory-db/gems/ember-source/CVE-2015-7565.yml +0 -30
  232. data/data/ruby-advisory-db/gems/enum_column3/OSVDB-94679.yml +0 -9
  233. data/data/ruby-advisory-db/gems/espeak-ruby/CVE-2016-10193.yml +0 -15
  234. data/data/ruby-advisory-db/gems/excon/CVE-2019-16779.yml +0 -23
  235. data/data/ruby-advisory-db/gems/extlib/CVE-2013-1802.yml +0 -18
  236. data/data/ruby-advisory-db/gems/fastreader/CVE-2013-2615.yml +0 -13
  237. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7222.yml +0 -17
  238. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7223.yml +0 -19
  239. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7224.yml +0 -17
  240. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7225.yml +0 -19
  241. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2013-7249.yml +0 -16
  242. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2014-5441.yml +0 -19
  243. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2015-1585.yml +0 -17
  244. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-1000842.yml +0 -23
  245. data/data/ruby-advisory-db/gems/fat_free_crm/CVE-2018-20975.yml +0 -12
  246. data/data/ruby-advisory-db/gems/faye/CVE-2020-11020.yml +0 -91
  247. data/data/ruby-advisory-db/gems/features/CVE-2013-4318.yml +0 -8
  248. data/data/ruby-advisory-db/gems/festivaltts4r/CVE-2016-10194.yml +0 -12
  249. data/data/ruby-advisory-db/gems/ffi/CVE-2018-1000201.yml +0 -22
  250. data/data/ruby-advisory-db/gems/field_test/CVE-2019-13146.yml +0 -20
  251. data/data/ruby-advisory-db/gems/fileutils/CVE-2013-2516.yml +0 -11
  252. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90715.yml +0 -7
  253. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90716.yml +0 -7
  254. data/data/ruby-advisory-db/gems/fileutils/OSVDB-90718.yml +0 -7
  255. data/data/ruby-advisory-db/gems/flash_tool/CVE-2013-2513.yml +0 -8
  256. data/data/ruby-advisory-db/gems/flavour_saver/OSVDB-110796.yml +0 -14
  257. data/data/ruby-advisory-db/gems/flukso4r/OSVDB-101577.yml +0 -7
  258. data/data/ruby-advisory-db/gems/fog-dragonfly/CVE-2013-1756.yml +0 -18
  259. data/data/ruby-advisory-db/gems/fog-dragonfly/CVE-2013-5671.yml +0 -16
  260. data/data/ruby-advisory-db/gems/fog-dragonfly/OSVDB-110439.yml +0 -15
  261. data/data/ruby-advisory-db/gems/fog-dragonfly/OSVDB-97854.yml +0 -12
  262. data/data/ruby-advisory-db/gems/ftpd/CVE-2013-2512.yml +0 -18
  263. data/data/ruby-advisory-db/gems/geminabox/CVE-2017-16792.yml +0 -21
  264. data/data/ruby-advisory-db/gems/gemirro/CVE-2017-16833.yml +0 -22
  265. data/data/ruby-advisory-db/gems/git-fastclone/CVE-2015-8968.yml +0 -21
  266. data/data/ruby-advisory-db/gems/git-fastclone/CVE-2015-8969.yml +0 -13
  267. data/data/ruby-advisory-db/gems/gitlab-grit/CVE-2013-4489.yml +0 -14
  268. data/data/ruby-advisory-db/gems/gnms/OSVDB-108594.yml +0 -7
  269. data/data/ruby-advisory-db/gems/gollum/CVE-2015-7314.yml +0 -13
  270. data/data/ruby-advisory-db/gems/gollum-grit_adapter/CVE-2014-9489.yml +0 -23
  271. data/data/ruby-advisory-db/gems/grape/CVE-2018-3769.yml +0 -20
  272. data/data/ruby-advisory-db/gems/gtk2/CVE-2007-6183.yml +0 -20
  273. data/data/ruby-advisory-db/gems/gyazo/CVE-2014-4994.yml +0 -10
  274. data/data/ruby-advisory-db/gems/haml/CVE-2017-1002201.yml +0 -19
  275. data/data/ruby-advisory-db/gems/handlebars-source/OSVDB-131671.yml +0 -17
  276. data/data/ruby-advisory-db/gems/http/CVE-2015-1828.yml +0 -14
  277. data/data/ruby-advisory-db/gems/httparty/CVE-2013-1801.yml +0 -14
  278. data/data/ruby-advisory-db/gems/i18n/CVE-2014-10077.yml +0 -18
  279. data/data/ruby-advisory-db/gems/i18n/OSVDB-100528.yml +0 -17
  280. data/data/ruby-advisory-db/gems/iodine/GHSA-85rf-xh54-whp3.yml +0 -21
  281. data/data/ruby-advisory-db/gems/jekyll/CVE-2018-17567.yml +0 -14
  282. data/data/ruby-advisory-db/gems/jquery-rails/CVE-2015-1840.yml +0 -36
  283. data/data/ruby-advisory-db/gems/jquery-rails/CVE-2019-11358.yml +0 -24
  284. data/data/ruby-advisory-db/gems/jquery-ui-rails/CVE-2016-7103.yml +0 -23
  285. data/data/ruby-advisory-db/gems/jquery-ujs/CVE-2015-1840.yml +0 -35
  286. data/data/ruby-advisory-db/gems/jruby-openssl/CVE-2009-4123.yml +0 -16
  287. data/data/ruby-advisory-db/gems/jruby-sandbox/OSVDB-106279.yml +0 -12
  288. data/data/ruby-advisory-db/gems/json/CVE-2013-0269.yml +0 -20
  289. data/data/ruby-advisory-db/gems/json/CVE-2020-10663.yml +0 -35
  290. data/data/ruby-advisory-db/gems/json/OSVDB-101157.yml +0 -14
  291. data/data/ruby-advisory-db/gems/json-jwt/CVE-2018-1000539.yml +0 -21
  292. data/data/ruby-advisory-db/gems/json-jwt/CVE-2019-18848.yml +0 -15
  293. data/data/ruby-advisory-db/gems/kafo/CVE-2014-0135.yml +0 -15
  294. data/data/ruby-advisory-db/gems/kajam/CVE-2014-4999.yml +0 -12
  295. data/data/ruby-advisory-db/gems/kajam/OSVDB-108530.yml +0 -11
  296. data/data/ruby-advisory-db/gems/kaminari/CVE-2020-11082.yml +0 -34
  297. data/data/ruby-advisory-db/gems/karo/OSVDB-108573.yml +0 -10
  298. data/data/ruby-advisory-db/gems/karteek-docsplit/CVE-2013-1933.yml +0 -9
  299. data/data/ruby-advisory-db/gems/kcapifony/CVE-2014-5001.yml +0 -8
  300. data/data/ruby-advisory-db/gems/kcapifony/OSVDB-108572.yml +0 -7
  301. data/data/ruby-advisory-db/gems/kelredd-pruview/CVE-2013-1947.yml +0 -9
  302. data/data/ruby-advisory-db/gems/kompanee-recipes/OSVDB-108593.yml +0 -12
  303. data/data/ruby-advisory-db/gems/lawn-login/CVE-2014-5000.yml +0 -8
  304. data/data/ruby-advisory-db/gems/ldap_fluff/CVE-2012-5604.yml +0 -15
  305. data/data/ruby-advisory-db/gems/ldoce/CVE-2013-1911.yml +0 -9
  306. data/data/ruby-advisory-db/gems/lean-ruport/CVE-2014-4998.yml +0 -8
  307. data/data/ruby-advisory-db/gems/lingq/OSVDB-108585.yml +0 -7
  308. data/data/ruby-advisory-db/gems/lita_coin/CVE-2019-15224.yml +0 -18
  309. data/data/ruby-advisory-db/gems/loofah/CVE-2018-16468.yml +0 -16
  310. data/data/ruby-advisory-db/gems/loofah/CVE-2018-8048.yml +0 -11
  311. data/data/ruby-advisory-db/gems/loofah/CVE-2019-15587.yml +0 -13
  312. data/data/ruby-advisory-db/gems/loofah/OSVDB-90945.yml +0 -21
  313. data/data/ruby-advisory-db/gems/lynx/CVE-2014-5002.yml +0 -11
  314. data/data/ruby-advisory-db/gems/lynx/OSVDB-108579.yml +0 -7
  315. data/data/ruby-advisory-db/gems/mail/CVE-2011-0739.yml +0 -21
  316. data/data/ruby-advisory-db/gems/mail/CVE-2012-2139.yml +0 -14
  317. data/data/ruby-advisory-db/gems/mail/CVE-2012-2140.yml +0 -16
  318. data/data/ruby-advisory-db/gems/mail/CVE-2015-9097.yml +0 -26
  319. data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-129854.yml +0 -25
  320. data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-132871.yml +0 -26
  321. data/data/ruby-advisory-db/gems/marginalia/CVE-2019-1010191.yml +0 -17
  322. data/data/ruby-advisory-db/gems/matestack-ui-core/CVE-2020-5241.yml +0 -18
  323. data/data/ruby-advisory-db/gems/md2pdf/CVE-2013-1948.yml +0 -9
  324. data/data/ruby-advisory-db/gems/mini_magick/CVE-2013-2616.yml +0 -15
  325. data/data/ruby-advisory-db/gems/mini_magick/CVE-2019-13574.yml +0 -14
  326. data/data/ruby-advisory-db/gems/minitar/CVE-2016-10173.yml +0 -20
  327. data/data/ruby-advisory-db/gems/moped/CVE-2015-4410.yml +0 -17
  328. data/data/ruby-advisory-db/gems/multi_xml/CVE-2013-0175.yml +0 -16
  329. data/data/ruby-advisory-db/gems/mustache-js-rails/OSVDB-131671.yml +0 -17
  330. data/data/ruby-advisory-db/gems/mysql-binuuid-rails/CVE-2018-18476.yml +0 -21
  331. data/data/ruby-advisory-db/gems/net-ldap/CVE-2014-0083.yml +0 -14
  332. data/data/ruby-advisory-db/gems/net-ldap/CVE-2017-17718.yml +0 -17
  333. data/data/ruby-advisory-db/gems/netaddr/CVE-2019-17383.yml +0 -13
  334. data/data/ruby-advisory-db/gems/newrelic_rpm/CVE-2013-0284.yml +0 -17
  335. data/data/ruby-advisory-db/gems/nokogiri/CVE-2012-6685.yml +0 -15
  336. data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6460.yml +0 -18
  337. data/data/ruby-advisory-db/gems/nokogiri/CVE-2013-6461.yml +0 -15
  338. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-1819.yml +0 -52
  339. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-5312.yml +0 -92
  340. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-7499.yml +0 -37
  341. data/data/ruby-advisory-db/gems/nokogiri/CVE-2015-8806.yml +0 -42
  342. data/data/ruby-advisory-db/gems/nokogiri/CVE-2016-4658.yml +0 -33
  343. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-15412.yml +0 -23
  344. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-16932.yml +0 -21
  345. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-5029.yml +0 -44
  346. data/data/ruby-advisory-db/gems/nokogiri/CVE-2017-9050.yml +0 -60
  347. data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-14404.yml +0 -69
  348. data/data/ruby-advisory-db/gems/nokogiri/CVE-2018-8048.yml +0 -36
  349. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-11068.yml +0 -49
  350. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-13117.yml +0 -80
  351. data/data/ruby-advisory-db/gems/nokogiri/CVE-2019-5477.yml +0 -31
  352. data/data/ruby-advisory-db/gems/nokogiri/CVE-2020-7595.yml +0 -20
  353. data/data/ruby-advisory-db/gems/nokogiri/OSVDB-118481.yml +0 -15
  354. data/data/ruby-advisory-db/gems/nori/CVE-2013-0285.yml +0 -19
  355. data/data/ruby-advisory-db/gems/omniauth/CVE-2015-9284.yml +0 -25
  356. data/data/ruby-advisory-db/gems/omniauth/CVE-2017-18076.yml +0 -18
  357. data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4562.yml +0 -22
  358. data/data/ruby-advisory-db/gems/omniauth-facebook/CVE-2013-4593.yml +0 -17
  359. data/data/ruby-advisory-db/gems/omniauth-oauth2/CVE-2012-6134.yml +0 -16
  360. data/data/ruby-advisory-db/gems/omniauth-saml/CVE-2017-11430.yml +0 -17
  361. data/data/ruby-advisory-db/gems/omniauth_amazon/CVE-2019-15224.yml +0 -19
  362. data/data/ruby-advisory-db/gems/open-uri-cached/OSVDB-121701.yml +0 -13
  363. data/data/ruby-advisory-db/gems/openssl/CVE-2016-7798.yml +0 -16
  364. data/data/ruby-advisory-db/gems/ox/CVE-2017-15928.yml +0 -16
  365. data/data/ruby-advisory-db/gems/ox/CVE-2017-16229.yml +0 -16
  366. data/data/ruby-advisory-db/gems/padrino-contrib/CVE-2019-16145.yml +0 -11
  367. data/data/ruby-advisory-db/gems/paperclip/CVE-2015-2963.yml +0 -16
  368. data/data/ruby-advisory-db/gems/paperclip/CVE-2017-0889.yml +0 -23
  369. data/data/ruby-advisory-db/gems/paperclip/OSVDB-103151.yml +0 -13
  370. data/data/ruby-advisory-db/gems/paranoid2/CVE-2019-13589.yml +0 -16
  371. data/data/ruby-advisory-db/gems/paratrooper-newrelic/CVE-2014-1234.yml +0 -13
  372. data/data/ruby-advisory-db/gems/paratrooper-pingdom/CVE-2014-1233.yml +0 -13
  373. data/data/ruby-advisory-db/gems/passenger/CVE-2013-2119.yml +0 -15
  374. data/data/ruby-advisory-db/gems/passenger/CVE-2013-4136.yml +0 -14
  375. data/data/ruby-advisory-db/gems/passenger/CVE-2014-1831.yml +0 -13
  376. data/data/ruby-advisory-db/gems/passenger/CVE-2014-1832.yml +0 -13
  377. data/data/ruby-advisory-db/gems/passenger/CVE-2015-7519.yml +0 -17
  378. data/data/ruby-advisory-db/gems/passenger/CVE-2016-10345.yml +0 -17
  379. data/data/ruby-advisory-db/gems/passenger/OSVDB-90738.yml +0 -16
  380. data/data/ruby-advisory-db/gems/pdfkit/CVE-2013-1607.yml +0 -11
  381. data/data/ruby-advisory-db/gems/point-cli/CVE-2014-4997.yml +0 -8
  382. data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0904.yml +0 -17
  383. data/data/ruby-advisory-db/gems/private_address_check/CVE-2017-0909.yml +0 -15
  384. data/data/ruby-advisory-db/gems/private_address_check/CVE-2018-3759.yml +0 -14
  385. data/data/ruby-advisory-db/gems/puma/CVE-2019-16770.yml +0 -21
  386. data/data/ruby-advisory-db/gems/puma/CVE-2020-11076.yml +0 -22
  387. data/data/ruby-advisory-db/gems/puma/CVE-2020-11077.yml +0 -31
  388. data/data/ruby-advisory-db/gems/puma/CVE-2020-5247.yml +0 -25
  389. data/data/ruby-advisory-db/gems/puma/CVE-2020-5249.yml +0 -36
  390. data/data/ruby-advisory-db/gems/quick_magick/OSVDB-106954.yml +0 -7
  391. data/data/ruby-advisory-db/gems/rack/CVE-2011-5036.yml +0 -21
  392. data/data/ruby-advisory-db/gems/rack/CVE-2012-6109.yml +0 -21
  393. data/data/ruby-advisory-db/gems/rack/CVE-2013-0183.yml +0 -19
  394. data/data/ruby-advisory-db/gems/rack/CVE-2013-0184.yml +0 -20
  395. data/data/ruby-advisory-db/gems/rack/CVE-2013-0262.yml +0 -18
  396. data/data/ruby-advisory-db/gems/rack/CVE-2013-0263.yml +0 -23
  397. data/data/ruby-advisory-db/gems/rack/CVE-2015-3225.yml +0 -18
  398. data/data/ruby-advisory-db/gems/rack/CVE-2018-16470.yml +0 -56
  399. data/data/ruby-advisory-db/gems/rack/CVE-2018-16471.yml +0 -80
  400. data/data/ruby-advisory-db/gems/rack/CVE-2019-16782.yml +0 -32
  401. data/data/ruby-advisory-db/gems/rack/CVE-2020-8161.yml +0 -32
  402. data/data/ruby-advisory-db/gems/rack-attack/OSVDB-132234.yml +0 -26
  403. data/data/ruby-advisory-db/gems/rack-cache/CVE-2012-2671.yml +0 -18
  404. data/data/ruby-advisory-db/gems/rack-cors/CVE-2017-11173.yml +0 -21
  405. data/data/ruby-advisory-db/gems/rack-cors/CVE-2019-18978.yml +0 -13
  406. data/data/ruby-advisory-db/gems/rack-mini-profiler/CVE-2016-4442.yml +0 -17
  407. data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-1000119.yml +0 -18
  408. data/data/ruby-advisory-db/gems/rack-protection/CVE-2018-7212.yml +0 -12
  409. data/data/ruby-advisory-db/gems/rack-ssl/CVE-2014-2538.yml +0 -11
  410. data/data/ruby-advisory-db/gems/radiant/CVE-2018-5216.yml +0 -12
  411. data/data/ruby-advisory-db/gems/radiant/CVE-2018-7261.yml +0 -13
  412. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7578.yml +0 -47
  413. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7579.yml +0 -75
  414. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2015-7580.yml +0 -70
  415. data/data/ruby-advisory-db/gems/rails-html-sanitizer/CVE-2018-3741.yml +0 -20
  416. data/data/ruby-advisory-db/gems/rails_admin/CVE-2016-10522.yml +0 -21
  417. data/data/ruby-advisory-db/gems/rails_admin/CVE-2017-12098.yml +0 -22
  418. data/data/ruby-advisory-db/gems/railties/CVE-2019-5420.yml +0 -49
  419. data/data/ruby-advisory-db/gems/rake/CVE-2020-8130.yml +0 -18
  420. data/data/ruby-advisory-db/gems/rbovirt/CVE-2014-0036.yml +0 -20
  421. data/data/ruby-advisory-db/gems/rdoc/CVE-2013-0256.yml +0 -27
  422. data/data/ruby-advisory-db/gems/recurly/CVE-2017-0905.yml +0 -35
  423. data/data/ruby-advisory-db/gems/redcarpet/CVE-2015-5147.yml +0 -17
  424. data/data/ruby-advisory-db/gems/redcarpet/OSVDB-120415.yml +0 -16
  425. data/data/ruby-advisory-db/gems/redis-namespace/OSVDB-96425.yml +0 -15
  426. data/data/ruby-advisory-db/gems/redis-store/CVE-2017-1000248.yml +0 -17
  427. data/data/ruby-advisory-db/gems/refile/OSVDB-120857.yml +0 -16
  428. data/data/ruby-advisory-db/gems/rest-client/CVE-2015-1820.yml +0 -23
  429. data/data/ruby-advisory-db/gems/rest-client/CVE-2015-3448.yml +0 -15
  430. data/data/ruby-advisory-db/gems/rest-client/CVE-2019-15224.yml +0 -13
  431. data/data/ruby-advisory-db/gems/restforce/CVE-2018-3777.yml +0 -36
  432. data/data/ruby-advisory-db/gems/rexical/CVE-2019-5477.yml +0 -21
  433. data/data/ruby-advisory-db/gems/rgpg/CVE-2013-4203.yml +0 -15
  434. data/data/ruby-advisory-db/gems/rubocop/CVE-2017-8418.yml +0 -20
  435. data/data/ruby-advisory-db/gems/ruby-openid/CVE-2019-11027.yml +0 -16
  436. data/data/ruby-advisory-db/gems/ruby-saml/CVE-2016-5697.yml +0 -20
  437. data/data/ruby-advisory-db/gems/ruby-saml/CVE-2017-11428.yml +0 -27
  438. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-117903.yml +0 -13
  439. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124383.yml +0 -11
  440. data/data/ruby-advisory-db/gems/ruby-saml/OSVDB-124991.yml +0 -13
  441. data/data/ruby-advisory-db/gems/ruby_parser/CVE-2013-0162.yml +0 -11
  442. data/data/ruby-advisory-db/gems/ruby_parser-legacy/CVE-2019-18409.yml +0 -16
  443. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2007-0469.yml +0 -18
  444. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2125.yml +0 -17
  445. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2012-2126.yml +0 -15
  446. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4287.yml +0 -20
  447. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2013-4363.yml +0 -21
  448. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-3900.yml +0 -20
  449. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2015-4020.yml +0 -20
  450. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0899.yml +0 -16
  451. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0900.yml +0 -16
  452. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0901.yml +0 -16
  453. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0902.yml +0 -16
  454. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2017-0903.yml +0 -17
  455. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8320.yml +0 -21
  456. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8321.yml +0 -16
  457. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8322.yml +0 -16
  458. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8323.yml +0 -17
  459. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8324.yml +0 -18
  460. data/data/ruby-advisory-db/gems/rubygems-update/CVE-2019-8325.yml +0 -16
  461. data/data/ruby-advisory-db/gems/rubyzip/CVE-2017-5946.yml +0 -17
  462. data/data/ruby-advisory-db/gems/rubyzip/CVE-2018-1000544.yml +0 -19
  463. data/data/ruby-advisory-db/gems/rubyzip/CVE-2019-16892.yml +0 -13
  464. data/data/ruby-advisory-db/gems/safemode/CVE-2016-3693.yml +0 -13
  465. data/data/ruby-advisory-db/gems/safemode/CVE-2017-7540.yml +0 -16
  466. data/data/ruby-advisory-db/gems/samlr/CVE-2018-20857.yml +0 -16
  467. data/data/ruby-advisory-db/gems/sanitize/CVE-2018-3740.yml +0 -22
  468. data/data/ruby-advisory-db/gems/screen_capture/OSVDB-107783.yml +0 -7
  469. data/data/ruby-advisory-db/gems/secure_headers/CVE-2020-5216.yml +0 -52
  470. data/data/ruby-advisory-db/gems/secure_headers/CVE-2020-5217.yml +0 -42
  471. data/data/ruby-advisory-db/gems/sentry-raven/CVE-2014-9490.yml +0 -14
  472. data/data/ruby-advisory-db/gems/sfpagent/CVE-2014-2888.yml +0 -15
  473. data/data/ruby-advisory-db/gems/show_in_browser/CVE-2013-2105.yml +0 -8
  474. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125675.yml +0 -9
  475. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125676.yml +0 -14
  476. data/data/ruby-advisory-db/gems/sidekiq/OSVDB-125678.yml +0 -9
  477. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126329.yml +0 -12
  478. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126330.yml +0 -10
  479. data/data/ruby-advisory-db/gems/sidekiq-pro/OSVDB-126331.yml +0 -14
  480. data/data/ruby-advisory-db/gems/simple_captcha2/CVE-2019-14282.yml +0 -13
  481. data/data/ruby-advisory-db/gems/simple_form/CVE-2019-16676.yml +0 -15
  482. data/data/ruby-advisory-db/gems/sinatra/CVE-2018-11627.yml +0 -16
  483. data/data/ruby-advisory-db/gems/sinatra/CVE-2018-7212.yml +0 -19
  484. data/data/ruby-advisory-db/gems/slanger/CVE-2019-1010306.yml +0 -16
  485. data/data/ruby-advisory-db/gems/smart_proxy_dynflow/CVE-2018-14643.yml +0 -18
  486. data/data/ruby-advisory-db/gems/sorcery/CVE-2020-11052.yml +0 -27
  487. data/data/ruby-advisory-db/gems/sounder/CVE-2013-5647.yml +0 -14
  488. data/data/ruby-advisory-db/gems/spina/CVE-2015-4619.yml +0 -16
  489. data/data/ruby-advisory-db/gems/spree/OSVDB-119205.yml +0 -18
  490. data/data/ruby-advisory-db/gems/spree/OSVDB-125699.yml +0 -18
  491. data/data/ruby-advisory-db/gems/spree/OSVDB-125701.yml +0 -17
  492. data/data/ruby-advisory-db/gems/spree/OSVDB-125712.yml +0 -16
  493. data/data/ruby-advisory-db/gems/spree/OSVDB-125713.yml +0 -15
  494. data/data/ruby-advisory-db/gems/spree/OSVDB-69098.yml +0 -19
  495. data/data/ruby-advisory-db/gems/spree/OSVDB-73751.yml +0 -11
  496. data/data/ruby-advisory-db/gems/spree/OSVDB-76011.yml +0 -15
  497. data/data/ruby-advisory-db/gems/spree/OSVDB-81505.yml +0 -14
  498. data/data/ruby-advisory-db/gems/spree/OSVDB-81506.yml +0 -16
  499. data/data/ruby-advisory-db/gems/spree/OSVDB-90865.yml +0 -20
  500. data/data/ruby-advisory-db/gems/spree/OSVDB-91216.yml +0 -17
  501. data/data/ruby-advisory-db/gems/spree/OSVDB-91217.yml +0 -17
  502. data/data/ruby-advisory-db/gems/spree/OSVDB-91218.yml +0 -17
  503. data/data/ruby-advisory-db/gems/spree/OSVDB-91219.yml +0 -17
  504. data/data/ruby-advisory-db/gems/spree_auth/OSVDB-90865.yml +0 -16
  505. data/data/ruby-advisory-db/gems/spree_auth_devise/OSVDB-90865.yml +0 -20
  506. data/data/ruby-advisory-db/gems/sprockets/CVE-2014-7819.yml +0 -27
  507. data/data/ruby-advisory-db/gems/sprockets/CVE-2018-3760.yml +0 -23
  508. data/data/ruby-advisory-db/gems/sprout/CVE-2013-6421.yml +0 -16
  509. data/data/ruby-advisory-db/gems/strong_password/CVE-2019-13354.yml +0 -19
  510. data/data/ruby-advisory-db/gems/sup/CVE-2013-4478.yml +0 -14
  511. data/data/ruby-advisory-db/gems/sup/CVE-2013-4479.yml +0 -14
  512. data/data/ruby-advisory-db/gems/thumbshooter/CVE-2013-1898.yml +0 -9
  513. data/data/ruby-advisory-db/gems/twitter-bootstrap-rails/OSVDB-109206.yml +0 -22
  514. data/data/ruby-advisory-db/gems/uglifier/OSVDB-126747.yml +0 -19
  515. data/data/ruby-advisory-db/gems/user_agent_parser/CVE-2020-5243.yml +0 -28
  516. data/data/ruby-advisory-db/gems/web-console/CVE-2015-3224.yml +0 -22
  517. data/data/ruby-advisory-db/gems/web-console/OSVDB-112346.yml +0 -12
  518. data/data/ruby-advisory-db/gems/webbynode/CVE-2013-7086.yml +0 -12
  519. data/data/ruby-advisory-db/gems/websocket-extensions/CVE-2020-7663.yml +0 -35
  520. data/data/ruby-advisory-db/gems/wicked/CVE-2013-4413.yml +0 -14
  521. data/data/ruby-advisory-db/gems/will_paginate/CVE-2013-6459.yml +0 -15
  522. data/data/ruby-advisory-db/gems/xaviershay-dm-rails/CVE-2015-2179.yml +0 -13
  523. data/data/ruby-advisory-db/gems/yajl-ruby/CVE-2017-16516.yml +0 -19
  524. data/data/ruby-advisory-db/gems/yard/CVE-2017-17042.yml +0 -16
  525. data/data/ruby-advisory-db/gems/yard/CVE-2019-1020001.yml +0 -17
  526. data/data/ruby-advisory-db/gems/yard/GHSA-xfhh-rx56-rxcr.yml +0 -12
  527. data/data/ruby-advisory-db/lib/cf_scrape.py +0 -5
  528. data/data/ruby-advisory-db/lib/github_advisory_sync.rb +0 -296
  529. data/data/ruby-advisory-db/libraries/rubygems +0 -1
  530. data/data/ruby-advisory-db/rubies/jruby/CVE-2010-1330.yml +0 -17
  531. data/data/ruby-advisory-db/rubies/jruby/CVE-2011-4838.yml +0 -15
  532. data/data/ruby-advisory-db/rubies/jruby/CVE-2012-5370.yml +0 -17
  533. data/data/ruby-advisory-db/rubies/jruby/OSVDB-94644.yml +0 -12
  534. data/data/ruby-advisory-db/rubies/rbx/CVE-2012-5372.yml +0 -17
  535. data/data/ruby-advisory-db/rubies/rbx/OSVDB-78119.yml +0 -13
  536. data/data/ruby-advisory-db/rubies/ruby/CVE-2007-5162.yml +0 -16
  537. data/data/ruby-advisory-db/rubies/ruby/CVE-2007-5770.yml +0 -17
  538. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-1447.yml +0 -15
  539. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-1891.yml +0 -21
  540. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2376.yml +0 -18
  541. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2662.yml +0 -22
  542. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2663.yml +0 -21
  543. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2664.yml +0 -21
  544. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2725.yml +0 -22
  545. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-2726.yml +0 -18
  546. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3443.yml +0 -17
  547. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3655.yml +0 -18
  548. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3656.yml +0 -19
  549. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3657.yml +0 -16
  550. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3790.yml +0 -16
  551. data/data/ruby-advisory-db/rubies/ruby/CVE-2008-3905.yml +0 -17
  552. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-0642.yml +0 -17
  553. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-1904.yml +0 -17
  554. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-4124.yml +0 -17
  555. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-4492.yml +0 -20
  556. data/data/ruby-advisory-db/rubies/ruby/CVE-2009-5147.yml +0 -13
  557. data/data/ruby-advisory-db/rubies/ruby/CVE-2010-0541.yml +0 -17
  558. data/data/ruby-advisory-db/rubies/ruby/CVE-2010-2489.yml +0 -17
  559. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-0188.yml +0 -17
  560. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-1004.yml +0 -20
  561. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-1005.yml +0 -15
  562. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2686.yml +0 -17
  563. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-2705.yml +0 -16
  564. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3009.yml +0 -17
  565. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-3389.yml +0 -18
  566. data/data/ruby-advisory-db/rubies/ruby/CVE-2011-4815.yml +0 -14
  567. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4464.yml +0 -17
  568. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4466.yml +0 -16
  569. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4481.yml +0 -15
  570. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-4522.yml +0 -16
  571. data/data/ruby-advisory-db/rubies/ruby/CVE-2012-5371.yml +0 -18
  572. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-1821.yml +0 -16
  573. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-2065.yml +0 -19
  574. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-4073.yml +0 -21
  575. data/data/ruby-advisory-db/rubies/ruby/CVE-2013-4164.yml +0 -17
  576. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-2525.yml +0 -20
  577. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-3916.yml +0 -16
  578. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-4975.yml +0 -17
  579. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-8080.yml +0 -19
  580. data/data/ruby-advisory-db/rubies/ruby/CVE-2014-8090.yml +0 -22
  581. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-1855.yml +0 -17
  582. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-7551.yml +0 -19
  583. data/data/ruby-advisory-db/rubies/ruby/CVE-2015-9096.yml +0 -20
  584. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-0898.yml +0 -19
  585. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-10784.yml +0 -25
  586. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14033.yml +0 -22
  587. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-14064.yml +0 -20
  588. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17405.yml +0 -22
  589. data/data/ruby-advisory-db/rubies/ruby/CVE-2017-17742.yml +0 -22
  590. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16395.yml +0 -36
  591. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-16396.yml +0 -26
  592. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-6914.yml +0 -27
  593. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8777.yml +0 -21
  594. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8778.yml +0 -20
  595. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8779.yml +0 -28
  596. data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8780.yml +0 -22
  597. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-15845.yml +0 -18
  598. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16201.yml +0 -15
  599. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16254.yml +0 -19
  600. data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml +0 -20
  601. data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml +0 -29
  602. data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml +0 -25
  603. data/data/ruby-advisory-db/scripts/post-advisories.sh +0 -18
  604. data/data/ruby-advisory-db/spec/advisories_spec.rb +0 -23
  605. data/data/ruby-advisory-db/spec/advisory_example.rb +0 -228
  606. data/data/ruby-advisory-db/spec/gem_example.rb +0 -44
  607. data/data/ruby-advisory-db/spec/library_example.rb +0 -21
  608. data/data/ruby-advisory-db/spec/ruby_example.rb +0 -29
  609. data/data/ruby-advisory-db/spec/schemas/gem.yml +0 -71
  610. data/data/ruby-advisory-db/spec/schemas/ruby.yml +0 -36
  611. data/data/ruby-advisory-db/spec/spec_helper.rb +0 -2
  612. data/data/ruby-advisory-db.ts +0 -1
@@ -1,55 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2015-7581
5
- date: 2016-01-25
6
- url: "https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE"
7
-
8
- title: Object leak vulnerability for wildcard controller routes in Action Pack
9
-
10
- description: |
11
- There is an object leak vulnerability for wildcard controllers in Action Pack.
12
- This vulnerability has been assigned the CVE identifier CVE-2015-7581.
13
-
14
- Versions Affected: >= 4.0.0 and < 5.0.0.beta1
15
- Not affected: < 4.0.0, 5.0.0.beta1 and newer
16
- Fixed Versions: 4.2.5.1, 4.1.14.1
17
-
18
- Impact
19
- ------
20
- Users that have a route that contains the string ":controller" are susceptible
21
- to objects being leaked globally which can lead to unbounded memory growth.
22
- To identify if your application is vulnerable, look for routes that contain
23
- ":controller".
24
-
25
- Internally, Action Pack keeps a map of "url controller name" to "controller
26
- class name". This map is cached globally, and is populated even if the
27
- controller class doesn't actually exist.
28
-
29
- All users running an affected release should either upgrade or use one of the
30
- workarounds immediately.
31
-
32
- Releases
33
- --------
34
- The FIXED releases are available at the normal locations.
35
-
36
- Workarounds
37
- -----------
38
- There are no feasible workarounds for this issue.
39
-
40
- Patches
41
- -------
42
- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
43
-
44
- * 4-1-wildcard_route.patch - Patch for 4.1 series
45
- * 4-2-wildcard_route.patch - Patch for 4.2 series
46
-
47
- Please note that only the 4.1.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
48
-
49
- unaffected_versions:
50
- - "< 4.0.0"
51
- - ">= 5.0.0.beta1"
52
-
53
- patched_versions:
54
- - "~> 4.2.5, >= 4.2.5.1"
55
- - "~> 4.1.14, >= 4.1.14.1"
@@ -1,74 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2016-0751
5
- date: 2016-01-25
6
- url: "https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc"
7
-
8
- title: Possible Object Leak and Denial of Service attack in Action Pack
9
-
10
- description: |
11
- There is a possible object leak which can lead to a denial of service
12
- vulnerability in Action Pack. This vulnerability has been
13
- assigned the CVE identifier CVE-2016-0751.
14
-
15
- Versions Affected: All.
16
- Not affected: None.
17
- Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
18
-
19
- Impact
20
- ------
21
- A carefully crafted accept header can cause a global cache of mime types to
22
- grow indefinitely which can lead to a possible denial of service attack in
23
- Action Pack.
24
-
25
- All users running an affected release should either upgrade or use one of the
26
- workarounds immediately.
27
-
28
- Releases
29
- --------
30
- The FIXED releases are available at the normal locations.
31
-
32
- Workarounds
33
- -----------
34
- This attack can be mitigated by a proxy that only allows known mime types in
35
- the Accept header.
36
-
37
- Placing the following code in an initializer will also mitigate the issue:
38
-
39
- ```ruby
40
- require 'action_dispatch/http/mime_type'
41
-
42
- Mime.const_set :LOOKUP, Hash.new { |h,k|
43
- Mime::Type.new(k) unless k.blank?
44
- }
45
- ```
46
-
47
- Patches
48
- -------
49
- To aid users who aren't able to upgrade immediately we have provided patches for
50
- the two supported release series. They are in git-am format and consist of a
51
- single changeset.
52
-
53
- * 5-0-mime_types_leak.patch - Patch for 5.0 series
54
- * 4-2-mime_types_leak.patch - Patch for 4.2 series
55
- * 4-1-mime_types_leak.patch - Patch for 4.1 series
56
- * 3-2-mime_types_leak.patch - Patch for 3.2 series
57
-
58
- Please note that only the 4.1.x and 4.2.x series are supported at present. Users
59
- of earlier unsupported releases are advised to upgrade as soon as possible as we
60
- cannot guarantee the continued availability of security fixes for unsupported
61
- releases.
62
-
63
- Credits
64
- -------
65
- Aaron Patterson <3<3
66
-
67
- cvss_v2: 5.0
68
- cvss_v3: 7.5
69
-
70
- patched_versions:
71
- - ">= 5.0.0.beta1.1"
72
- - "~> 4.2.5, >= 4.2.5.1"
73
- - "~> 4.1.14, >= 4.1.14.1"
74
- - "~> 3.2.22.1"
@@ -1,96 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2016-0752
5
- date: 2016-01-25
6
- url: "https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00"
7
-
8
- title: Possible Information Leak Vulnerability in Action View
9
- description: |
10
- There is a possible directory traversal and information leak vulnerability in
11
- Action View. This vulnerability has been assigned the CVE identifier
12
- CVE-2016-0752.
13
-
14
- Versions Affected: All.
15
- Not affected: None.
16
- Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
17
-
18
- Impact
19
- ------
20
- Applications that pass unverified user input to the `render` method in a
21
- controller may be vulnerable to an information leak vulnerability.
22
-
23
- Impacted code will look something like this:
24
-
25
- ```ruby
26
- def index
27
- render params[:id]
28
- end
29
- ```
30
-
31
- Carefully crafted requests can cause the above code to render files from
32
- unexpected places like outside the application's view directory, and can
33
- possibly escalate this to a remote code execution attack.
34
-
35
- All users running an affected release should either upgrade or use one of the
36
- workarounds immediately.
37
-
38
- Releases
39
- --------
40
- The FIXED releases are available at the normal locations.
41
-
42
- Workarounds
43
- -----------
44
- A workaround to this issue is to not pass arbitrary user input to the `render`
45
- method. Instead, verify that data before passing it to the `render` method.
46
-
47
- For example, change this:
48
-
49
- ```ruby
50
- def index
51
- render params[:id]
52
- end
53
- ```
54
-
55
- To this:
56
-
57
- ```ruby
58
- def index
59
- render verify_template(params[:id])
60
- end
61
-
62
- private
63
- def verify_template(name)
64
- # add verification logic particular to your application here
65
- end
66
- ```
67
-
68
- Patches
69
- -------
70
- To aid users who aren't able to upgrade immediately we have provided patches for
71
- the two supported release series. They are in git-am format and consist of a
72
- single changeset.
73
-
74
- * 3-2-render_data_leak.patch - Patch for 3.2 series
75
- * 4-1-render_data_leak.patch - Patch for 4.1 series
76
- * 4-2-render_data_leak.patch - Patch for 4.2 series
77
- * 5-0-render_data_leak.patch - Patch for 5.0 series
78
-
79
- Please note that only the 4.1.x and 4.2.x series are supported at present. Users
80
- of earlier unsupported releases are advised to upgrade as soon as possible as we
81
- cannot guarantee the continued availability of security fixes for unsupported
82
- releases.
83
-
84
- Credits
85
- -------
86
- Thanks John Poulin for reporting this!
87
-
88
- unaffected_versions:
89
- # Newer versions are affected, but tracked in the actionview gem.
90
- - ">= 4.1.0"
91
-
92
- patched_versions:
93
- - ">= 5.0.0.beta1.1"
94
- - "~> 4.2.5, >= 4.2.5.1"
95
- - "~> 4.1.14, >= 4.1.14.1"
96
- - "~> 3.2.22.1"
@@ -1,91 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2016-2097
5
- date: 2016-02-29
6
- url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4"
7
-
8
- title: Possible Information Leak Vulnerability in Action View
9
-
10
- description: |
11
-
12
- There is a possible directory traversal and information leak vulnerability
13
- in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2
14
- patch was not covering all the scenarios. This vulnerability has been
15
- assigned the CVE identifier CVE-2016-2097.
16
-
17
- Versions Affected: 3.2.x, 4.0.x, 4.1.x
18
- Not affected: 4.2+
19
- Fixed Versions: 3.2.22.2, 4.1.14.2
20
-
21
- Impact
22
- ------
23
- Applications that pass unverified user input to the `render` method in a
24
- controller may be vulnerable to an information leak vulnerability.
25
-
26
- Impacted code will look something like this:
27
-
28
- ```ruby
29
- def index
30
- render params[:id]
31
- end
32
- ```
33
-
34
- Carefully crafted requests can cause the above code to render files from
35
- unexpected places like outside the application's view directory, and can
36
- possibly escalate this to a remote code execution attack.
37
-
38
- All users running an affected release should either upgrade or use one of the
39
- workarounds immediately.
40
-
41
- Releases
42
- --------
43
- The FIXED releases are available at the normal locations.
44
-
45
- Workarounds
46
- -----------
47
- A workaround to this issue is to not pass arbitrary user input to the `render`
48
- method. Instead, verify that data before passing it to the `render` method.
49
-
50
- For example, change this:
51
-
52
- ```ruby
53
- def index
54
- render params[:id]
55
- end
56
- ```
57
-
58
- To this:
59
-
60
- ```ruby
61
- def index
62
- render verify_template(params[:id])
63
- end
64
-
65
- private
66
- def verify_template(name)
67
- # add verification logic particular to your application here
68
- end
69
- ```
70
-
71
- Patches
72
- -------
73
- To aid users who aren't able to upgrade immediately we have provided patches
74
- for it. It is in git-am format and consist of a single changeset.
75
-
76
- * 3-2-render_data_leak_2.patch - Patch for 3.2 series
77
- * 4-1-render_data_leak_2.patch - Patch for 4.1 series
78
-
79
- Credits
80
- -------
81
- Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this
82
- and working with us in the patch!
83
-
84
- unaffected_versions:
85
- # Newer versions are affected, but tracked in the actionview gem.
86
- - ">= 4.1.0"
87
-
88
- patched_versions:
89
- - "~> 3.2.22.2"
90
- - "~> 4.1.14"
91
- - ">= 4.1.14.2"
@@ -1,89 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2016-2098
5
- date: 2016-02-29
6
- url: "https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q"
7
-
8
- title: Possible remote code execution vulnerability in Action Pack
9
-
10
- description: |
11
- There is a possible remote code execution vulnerability in Action Pack.
12
- This vulnerability has been assigned the CVE identifier CVE-2016-2098.
13
-
14
- Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x
15
- Not affected: 5.0+
16
- Fixed Versions: 3.2.22.2, 4.1.14.2, 4.2.5.2
17
-
18
- Impact
19
- ------
20
- Applications that pass unverified user input to the `render` method in a
21
- controller or a view may be vulnerable to a code injection.
22
-
23
- Impacted code will look like this:
24
-
25
- ```ruby
26
- class TestController < ApplicationController
27
- def show
28
- render params[:id]
29
- end
30
- end
31
- ```
32
-
33
- An attacker could use the request parameters to coerce the above example
34
- to execute arbitrary ruby code.
35
-
36
- All users running an affected release should either upgrade or use one of
37
- the workarounds immediately.
38
-
39
- Releases
40
- --------
41
- The FIXED releases are available at the normal locations.
42
-
43
- Workarounds
44
- -----------
45
- A workaround to this issue is to not pass arbitrary user input to the `render`
46
- method. Instead, verify that data before passing it to the `render` method.
47
-
48
- For example, change this:
49
-
50
- ```ruby
51
- def index
52
- render params[:id]
53
- end
54
- ```
55
-
56
- To this:
57
-
58
- ```ruby
59
- def index
60
- render verify_template(params[:id])
61
- end
62
-
63
- private
64
- def verify_template(name)
65
- # add verification logic particular to your application here
66
- end
67
- ```
68
-
69
- Patches
70
- -------
71
- To aid users who aren't able to upgrade immediately we have provided a
72
- patch for it. It is in git-am format and consist of a single changeset.
73
-
74
- * 3-2-secure_inline_with_params.patch - Patch for 3.2 series
75
- * 4-1-secure_inline_with_params.patch - Patch for 4.1 series
76
- * 4-2-secure_inline_with_params.patch - Patch for 4.2 series
77
-
78
- Credits
79
- -------
80
- Thanks to both Tobias Kraze from makandra and joernchen of Phenoelit for
81
- reporting this!
82
-
83
- unaffected_versions:
84
- - ">= 5.0.0.beta1"
85
-
86
- patched_versions:
87
- - "~> 3.2.22.2"
88
- - "~> 4.2.5, >= 4.2.5.2"
89
- - "~> 4.1.14, >= 4.1.14.2"
@@ -1,57 +0,0 @@
1
- ---
2
- gem: actionpack
3
- framework: rails
4
- cve: 2016-6316
5
- date: 2016-08-11
6
- url: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
7
-
8
- title: Possible XSS Vulnerability in Action View
9
-
10
- description: |
11
- There is a possible XSS vulnerability in Action View. Text declared as "HTML
12
- safe" will not have quotes escaped when used as attribute values in tag
13
- helpers.
14
-
15
- Impact
16
- ------
17
-
18
- Text declared as "HTML safe" when passed as an attribute value to a tag helper
19
- will not have quotes escaped which can lead to an XSS attack. Impacted code
20
- looks something like this:
21
-
22
- ```ruby
23
- content_tag(:div, "hi", title: user_input.html_safe)
24
- ```
25
-
26
- Some helpers like the `sanitize` helper will automatically mark strings as
27
- "HTML safe", so impacted code could also look something like this:
28
-
29
- ```ruby
30
- content_tag(:div, "hi", title: sanitize(user_input))
31
- ```
32
-
33
- All users running an affected release should either upgrade or use one of the
34
- workarounds immediately.
35
-
36
- Workarounds
37
- -----------
38
- You can work around this issue by either *not* marking arbitrary user input as
39
- safe, or by manually escaping quotes like this:
40
-
41
- ```ruby
42
- def escape_quotes(value)
43
- value.gsub(/"/, '&quot;'.freeze)
44
- end
45
-
46
- content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
47
- ```
48
-
49
- unaffected_versions:
50
- - "< 3.0.0"
51
- # Newer versions are affected, but tracked in the actionview gem.
52
- - ">= 4.1.0"
53
-
54
- patched_versions:
55
- - ~> 3.2.22.3
56
- - ~> 4.2.7.1
57
- - ">= 5.0.0.1"