jquery-rails 3.1.2 → 3.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 98bf989826e397d74ec16b1a4a7c4abec2abf9aa
-  data.tar.gz: f49b1a849a7fa680e2c3ccb51033fb5f8ac2a84e
+  metadata.gz: f2fb7c1bc54c76ac75d4d6ba5aa8a4180e635ce9
+  data.tar.gz: 8d546a3a4f7dac4337f9d70abd7b339f15a3bfd2
 SHA512:
-  metadata.gz: 27f7d0e1dc0263585ed78f0665422d3d855c6e7367e9bc7c1db7b09fb01eb834402faad34baa7c2b02f3b536cc61a91012b239a29d21f8bc1c045db0eeec4d54
-  data.tar.gz: 1913187a31b4be7a2e92122850ea84e124688282a6ea370022767e4394f5759360cf08eedebb4f633c9cb59aa1c842b0aaaf5f5eeeb8bd3c839a02345001c98c
+  metadata.gz: 30921a1b02aabac4035a959719a62fe48283331124baca8fc78961ec0266903e88e935fd570e57c6cf27d7fb46328a6676fd4f6c6b70ae53bc1f8af2889c2df0
+  data.tar.gz: c21818f07a70497e53f48e6024d5d008ecdac28e276401f7743b0afcb6609803bb52f53f0c5a3b9a01c754adc0759a808e92fc4ef27b7ed1d17e95f026e9f120

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 3.1.3 (16 June 2015)
+
+  - Fix CSP bypass vulnerability. CVE-2015-1840
+
 ## 3.1.2 (1 September 2014)
 
   - Updated to jquery-ujs 1.0.1

data/VERSIONS.md

@@ -2,6 +2,7 @@
 
 | Gem    | jQuery | jQuery UJS | jQuery UI |
 |--------|--------|------------| ----------|
+| 3.1.3  | 1.11.1 | 1.0.4      | -         |
 | 3.1.2  | 1.11.1 | 1.0.1      | -         |
 | 3.1.1  | 1.11.1 | 1.0.0      | -         |
 | 3.1.0  | 1.11.0 | -          | -         |

data/lib/jquery/rails/version.rb

@@ -1,7 +1,7 @@
 module Jquery
   module Rails
-    VERSION = "3.1.2"
+    VERSION = "3.1.3"
     JQUERY_VERSION = "1.11.1"
-    JQUERY_UJS_VERSION = "1.0.1"
+    JQUERY_UJS_VERSION = "1.0.4"
   end
 end

data/vendor/assets/javascripts/jquery_ujs.js

@@ -86,16 +86,14 @@
 
     // Default way to get an element's href. May be overridden at $.rails.href.
     href: function(element) {
-      return element.attr('href');
+      return element[0].href;
     },
 
     // Submits "remote" forms and links with ajax
     handleRemote: function(element) {
-      var method, url, data, elCrossDomain, crossDomain, withCredentials, dataType, options;
+      var method, url, data, withCredentials, dataType, options;
 
       if (rails.fire(element, 'ajax:before')) {
-        elCrossDomain = element.data('cross-domain');
-        crossDomain = elCrossDomain === undefined ? null : elCrossDomain;
         withCredentials = element.data('with-credentials') || null;
         dataType = element.data('type') || ($.ajaxSettings && $.ajaxSettings.dataType);
 
@@ -147,7 +145,7 @@
           error: function(xhr, status, error) {
             element.trigger('ajax:error', [xhr, status, error]);
           },
-          crossDomain: crossDomain
+          crossDomain: rails.isCrossDomain(url)
         };
 
         // There is no withCredentials for IE6-8 when
@@ -167,6 +165,27 @@
       }
     },
 
+    // Determines if the request is a cross domain request.
+    isCrossDomain: function(url) {
+      var originAnchor = document.createElement("a");
+      originAnchor.href = location.href;
+      var urlAnchor = document.createElement("a");
+
+      try {
+        urlAnchor.href = url;
+        // This is a workaround to a IE bug.
+        urlAnchor.href = urlAnchor.href;
+
+        // Make sure that the browser parses the URL and that the protocols and hosts match.
+        return !urlAnchor.protocol || !urlAnchor.host ||
+          (originAnchor.protocol + "//" + originAnchor.host !==
+            urlAnchor.protocol + "//" + urlAnchor.host);
+      } catch (e) {
+        // If there is an error parsing the URL, assume it is crossDomain.
+        return true;
+      }
+    },
+
     // Handles "data-method" on links such as:
     // <a href="/users/5" data-method="delete" rel="nofollow" data-confirm="Are you sure?">Delete</a>
     handleMethod: function(link) {
@@ -178,7 +197,7 @@
         form = $('<form method="post" action="' + href + '"></form>'),
         metadataInput = '<input name="_method" value="' + method + '" type="hidden" />';
 
-      if (csrfParam !== undefined && csrfToken !== undefined) {
+      if (csrfParam !== undefined && csrfToken !== undefined && !rails.isCrossDomain(href)) {
         metadataInput += '<input name="' + csrfParam + '" value="' + csrfToken + '" type="hidden" />';
       }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jquery-rails
 version: !ruby/object:Gem::Version
-  version: 3.1.2
+  version: 3.1.3
 platform: ruby
 authors:
 - André Arko
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-02 00:00:00.000000000 Z
+date: 2015-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -98,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.6
 requirements: []
 rubyforge_project: jquery-rails
-rubygems_version: 2.2.2
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Use jQuery with Rails 3+