rack-post-body-to-params 0.1.7 → 0.1.8

data/README.rdoc

@@ -1,6 +1,6 @@
 = Security advice
 
-Rack::PostBodyToParams is affected by every Rails security issue induced by YAML deserialization for HTTP POST bodys as it just uses ActionSupport for that. You should either upgrade ActiveSupport or require 'safe_yaml'. As of version 0.1.6 Rack::PostBodyToParams will  prevent you from initializing if Hash.from_xml is unsafe.
+Rack::PostBodyToParams is affected by every Rails security issue induced by YAML deserialization for HTTP POST bodys as it just uses ActionSupport for that. You should either upgrade ActiveSupport or require the 'safe_yaml' gem. As of version 0.1.6 Rack::PostBodyToParams will prevent you from initializing if the XML parser is unsafe. It defaults to ActiveSupports Hash#from_xml.
 
 = Rack::PostBodyToParams
 

data/VERSION

@@ -1 +1 @@
-0.1.7
+0.1.8

data/lib/rack/post-body-to-params.rb

@@ -28,6 +28,8 @@ module Rack
         raise Exception, 'Please educate about the ActiveSupport YAML remote code execution vulnerability and take measures. Either install and require safe_yaml or upgrade ActiveSupport'
       end
     end
+    
+    class YamlNotSafe < Exception; end
 
     # Constants
     #
@@ -70,11 +72,12 @@ module Rack
       # Check wether we're vulnerable via YAML:
       begin
         parsers[APPLICATION_XML].call %Q{<?xml version="1.0" encoding="UTF-8"?><bang type="yaml">--- !ruby/hash:Rack::PostBodyToParams::RCETEST\n  foo: bar</bang>}
+        # We shouldn't get here, the safe thing is to throw an exception (which ActiveSupport 3.1.x+ and safe_yaml )
+        raise YamlNotSafe, 'Please educate about the ActiveSupport YAML remote code execution vulnerability and take measures. Either install and require safe_yaml or upgrade ActiveSupport'
+      rescue YamlNotSafe => yns
+        raise yns
       rescue Exception => e
-        # If ActiveSupport caught the error, we're safe. Otherwise, exception.
-        unless e.kind_of?(Hash::DisallowedType)
-          raise Exception, 'Please educate about the ActiveSupport YAML remote code execution vulnerability and take measures. Either install and require safe_yaml or upgrade ActiveSupport'
-        end
+        # Do nothing, we expect this to happen when we have safe parsing
       end
 
       @app = app

data/rack-post-body-to-params.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "rack-post-body-to-params"
-  s.version = "0.1.7"
+  s.version = "0.1.8"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Niko Dittmann"]
-  s.date = "2013-02-05"
+  s.date = "2013-09-12"
   s.email = "mail+git@niko-dittmann.com"
   s.extra_rdoc_files = [
     "LICENSE",
@@ -29,7 +29,7 @@ Gem::Specification.new do |s|
   ]
   s.homepage = "http://github.com/niko/rack-post-body-to-params"
   s.require_paths = ["lib"]
-  s.rubygems_version = "1.8.10"
+  s.rubygems_version = "1.8.25"
   s.summary = "A Rack middleware that parses the POST or PUT body for JSON or XML content to a Hash and puts it into the rack.request.form_hash. Most frameworks get the params hash from there. Uses ActiveSupport and the respective parsers for parsing. So you can set it up to use Nokogiri and YajL. Useful for example when writing JSON and XML API apps with Sinatra or Padrino."
 
   if s.respond_to? :specification_version then

data/test/test_post-body-to-params.rb

@@ -121,6 +121,31 @@ class TestPostBodyToParams < Test::Unit::TestCase
       assert_equal 'application/xml', header['Content-Type']
       assert_match /xml-syntax-error/, body.first
     end
+    should "check at init to make sure yaml parsing will not happen" do
+      test_app = TestApp.new
+      if Hash.const_defined?("DisallowedType")
+        Hash::DISALLOWED_XML_TYPES.delete("yaml")
+        begin
+          assert_raise Rack::PostBodyToParams::YamlNotSafe do
+            Rack::PostBodyToParams.new test_app
+          end
+        ensure
+          Hash::DISALLOWED_XML_TYPES << "yaml"
+        end
+      elsif Kernel.const_defined?("ActiveSupport") &&
+          ActiveSupport.const_defined?("XMLConverter") &&
+          ActiveSupport::XMLConverter.const_defined?("DisallowedType")
+        ActiveSupport::XMLConverter::DISALLOWED_TYPES.delete("yaml")
+        begin
+          assert_raise Rack::PostBodyToParams::YamlNotSafe do
+            Rack::PostBodyToParams.new test_app
+          end
+        ensure
+          ActiveSupport::XMLConverter::DISALLOWED_TYPES << "yaml"
+        end
+      end
+    end
+      
   end
   
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-post-body-to-params
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.1.8
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-05 00:00:00.000000000Z
+date: 2013-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: shoulda
-  requirement: &70162486027220 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70162486027220
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
-  requirement: &70162486026720 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,7 +37,12 @@ dependencies:
         version: '2.3'
   type: :runtime
   prerelease: false
-  version_requirements: *70162486026720
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '2.3'
 description: 
 email: mail+git@niko-dittmann.com
 executables: []
@@ -71,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.10
+rubygems_version: 1.8.25
 signing_key: 
 specification_version: 3
 summary: A Rack middleware that parses the POST or PUT body for JSON or XML content