gon 6.3.2 → 6.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4be940f45c3dff8c909d94552a81b3240ccea1dd42d5c442c18400278564286
-  data.tar.gz: 86efc334a694c3a9825ec909f34bd5138b601de0108172863adb4d651eccdb28
+  metadata.gz: 3bdd0446070acfd94f0e8ef48b57eb1bfdf82179dca4cdd7a6e230d43ee9551b
+  data.tar.gz: 3dea439ff1cefa4edef65a9c39f2d0e505114140fcbf1a9effda085f04741e64
 SHA512:
-  metadata.gz: 9adb780569a41eb32cf547f7ffebf22b184fdda8c63aa6d7c2e5e9b0efe789e2ec5a187cec83d4ca4ef0bc068148708adf1a7541752dcad83228dc4c5cf08920
-  data.tar.gz: da49fd8d8e2b683bd69fa2e5f37e8f912faa4496a3f81739022b68f2bea5cd1762c0b3b54c25426756499e8096c9822ff36ce7e854e771db28237988c5e4385b
+  metadata.gz: af0597738e9196231399b4c15e77358bb4e3e90cbfe26fefae9da4d70ae5c20982c15c424e34b37ed58cd05cf8e867f6756cfa83f8621eda301df266ab5ff251
+  data.tar.gz: 37a2e08e06f44c863bfce115e99c9628f798347b2db2579b491d38aa959b5e5ee076b9207ae02405e303b94c8952198becef9f2d24fce8f79bd7a0b5cf001339

data/.travis.yml

@@ -6,7 +6,9 @@ env:
 
 rvm:
   - 2.2.10
-  - 2.3.7
-  - 2.4.4
-  - 2.5.1
+  - 2.3.8
+  - 2.4.10
+  - 2.5.8
+  - 2.6.6
+  - 2.7.1
   - ruby-head

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [6.4.0] - 2020-09-18
+### Security
+- CVE-2020-25739: Enforce HTML entities escaping in gon output
+
 ## [6.3.2] - 2019-11-18
 ### Security
 - Restrict possibility of vulnerable i18n legacy verision (0.3.6.pre)
@@ -226,7 +230,8 @@
 ### Changed
 - Don't really remember what was before this version
 
-[Unreleased]: https://github.com/gazay/gon/compare/v6.3.1...master
+[Unreleased]: https://github.com/gazay/gon/compare/v6.3.2...master
+[6.3.2]: https://github.com/gazay/gon/compare/v6.3.1...v6.3.2
 [6.3.1]: https://github.com/gazay/gon/compare/v6.2.1...v6.3.1
 [6.2.1]: https://github.com/gazay/gon/compare/v6.2.0...v6.2.1
 [6.2.0]: https://github.com/gazay/gon/compare/v6.1.0...v6.2.0

data/gon.gemspec

@@ -27,4 +27,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'railties', '>= 3.0.20'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'pry'
+  s.add_development_dependency 'pry-byebug'
 end

data/lib/gon/json_dumper.rb

@@ -1,8 +1,23 @@
 class Gon
   module JsonDumper
+    # Taken from ERB::Util
+    JSON_ESCAPE_REGEXP	=	/[\u2028\u2029&><]/u
+    JSON_ESCAPE	=	{
+      "&" => '\u0026',
+      ">" => '\u003e',
+      "<" => '\u003c',
+      "\u2028" => '\u2028',
+      "\u2029" => '\u2029'
+    }
+
     def self.dump(object)
-      MultiJson.dump object,
+      dumped_json = MultiJson.dump object,
         mode: :compat, escape_mode: :xss_safe, time_format: :ruby
+      escape(dumped_json)
+    end
+
+    def self.escape(json)
+      json.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
     end
   end
 end

data/lib/gon/spec_helpers.rb

@@ -5,7 +5,7 @@ class Gon
 
       module ClassMethods
         module GonSession
-          def process(*)
+          def process(*, **)
             # preload threadlocal & store controller instance
             if controller.is_a? ActionController::Base
               controller.gon

data/lib/gon/version.rb

@@ -1,3 +1,3 @@
 class Gon
-  VERSION = '6.3.2'
+  VERSION = '6.4.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gon
 version: !ruby/object:Gem::Version
-  version: 6.3.2
+  version: 6.4.0
 platform: ruby
 authors:
 - gazay
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-19 00:00:00.000000000 Z
+date: 2020-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -164,6 +164,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: If you need to send some data to your js files and you don't want to
   do this with long way trough views and parsing - use this force!
 email:
@@ -239,7 +253,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Get your Rails variables in your JS