rack-post-body-to-params 0.1.6 → 0.1.7

data/VERSION

@@ -1 +1 @@
-0.1.6
+0.1.7

data/lib/rack/post-body-to-params.rb

@@ -54,22 +54,29 @@ module Rack
     #
     def initialize(app, config={})
       @content_types = config.delete(:content_types) || [APPLICATION_JSON, APPLICATION_XML]
-      
+
       @parsers = {
         APPLICATION_JSON => Proc.new{ |post_body| parse_as_json post_body },
         APPLICATION_XML =>  Proc.new{ |post_body| parse_as_xml  post_body }
       }
       @parsers.update(config[:parsers]) if config[:parsers]
-      
+
       @error_responses = {
         APPLICATION_JSON => Proc.new{ |error| json_error_response error },
         APPLICATION_XML =>  Proc.new{ |error| xml_error_response  error }
       }
       @error_responses.update(config[:error_responses]) if config[:error_responses]
-      
+
       # Check wether we're vulnerable via YAML:
-      parsers[APPLICATION_XML].call %Q{<?xml version="1.0" encoding="UTF-8"?><bang type="yaml">--- !ruby/hash:Rack::PostBodyToParams::RCETEST\n  foo: bar</bang>}
-      
+      begin
+        parsers[APPLICATION_XML].call %Q{<?xml version="1.0" encoding="UTF-8"?><bang type="yaml">--- !ruby/hash:Rack::PostBodyToParams::RCETEST\n  foo: bar</bang>}
+      rescue Exception => e
+        # If ActiveSupport caught the error, we're safe. Otherwise, exception.
+        unless e.kind_of?(Hash::DisallowedType)
+          raise Exception, 'Please educate about the ActiveSupport YAML remote code execution vulnerability and take measures. Either install and require safe_yaml or upgrade ActiveSupport'
+        end
+      end
+
       @app = app
     end
 
@@ -89,10 +96,10 @@ module Rack
 
     def call(env)
       content_type = env[CONTENT_TYPE] && env[CONTENT_TYPE].split(';').first
-      
+
       if content_type && @content_types.include?(content_type)
         post_body = env[POST_BODY].read
-        
+
         unless post_body.blank?
           begin
             new_form_hash = parsers[content_type].call post_body
@@ -102,9 +109,9 @@ module Rack
           end
           env.update(FORM_HASH => new_form_hash, FORM_INPUT => env[POST_BODY])
         end
-        
+
       end
-      
+
       @app.call(env)
     end
 

data/rack-post-body-to-params.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "rack-post-body-to-params"
-  s.version = "0.1.6"
+  s.version = "0.1.7"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Niko Dittmann"]
-  s.date = "2013-02-04"
+  s.date = "2013-02-05"
   s.email = "mail+git@niko-dittmann.com"
   s.extra_rdoc_files = [
     "LICENSE",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-post-body-to-params
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-04 00:00:00.000000000Z
+date: 2013-02-05 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: shoulda
-  requirement: &70269260206680 !ruby/object:Gem::Requirement
+  requirement: &70162486027220 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70269260206680
+  version_requirements: *70162486027220
 - !ruby/object:Gem::Dependency
   name: activesupport
-  requirement: &70269260205440 !ruby/object:Gem::Requirement
+  requirement: &70162486026720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,7 +32,7 @@ dependencies:
         version: '2.3'
   type: :runtime
   prerelease: false
-  version_requirements: *70269260205440
+  version_requirements: *70162486026720
 description: 
 email: mail+git@niko-dittmann.com
 executables: []