rails-security-backports 0.0.2 → 0.0.3

data/CHANGELOG.md

@@ -1,6 +1,10 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 0.0.3 - 2015-01-22
+### Added
+- Ruby: CVE-2014-8090
+
 ## 0.0.2 - 2014-11-03
 ### Changed
 - require rake 0.9.2 specifically, for full Ruby 1.8.6 compatibility

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rails-security-backports (0.0.2)
+    rails-security-backports (0.0.3)
 
 GEM
   remote: https://rubygems.org/

data/lib/rails-security-backports/ruby-cve-backports/cve-2014-8090.rb

@@ -0,0 +1,13 @@
+# Fixes CVE-2014-8090 - https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/
+
+require 'rexml/document'
+
+module REXML
+  class Document
+
+    def document
+      self
+    end
+
+  end
+end

data/lib/rails-security-backports/version.rb

@@ -2,7 +2,7 @@ module RailsSecurityBackports
   class Version
     MAJOR = 0
     MINOR = 0
-    PATCH = 2
+    PATCH = 3
     STRING = "#{MAJOR}.#{MINOR}.#{PATCH}"
 
     class << self

data/test/ruby-cve-2014-8090_test.rb

@@ -0,0 +1,13 @@
+require 'test/unit'
+require 'rails-security-backports'
+
+class RubyCve_2014_8090Test < Test::Unit::TestCase
+
+  # Unfortunately I was not able to find the test-case where this vulnerability exists.
+  # In my testing, the patch for ruby-cve-2008-3790 offered sufficient protection
+  # and also very closely matches the change in `REXML::Entity between 1.9.3-p484 & p551.
+  def test_no_tests_available
+    assert(true)
+  end
+
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: rails-security-backports
 version: !ruby/object:Gem::Version 
-  hash: 27
+  hash: 25
   prerelease: 
   segments: 
   - 0
   - 0
-  - 2
-  version: 0.0.2
+  - 3
+  version: 0.0.3
 platform: ruby
 authors: 
 - Marcos Wright Kuhns
@@ -70,10 +70,12 @@ files:
 - lib/rails-security-backports/rails-cve-backports/cve-2013-0277.rb
 - lib/rails-security-backports/ruby-cve-backports/cve-2008-3790.rb
 - lib/rails-security-backports/ruby-cve-backports/cve-2014-8080.rb
+- lib/rails-security-backports/ruby-cve-backports/cve-2014-8090.rb
 - lib/rails-security-backports/version.rb
 - rails-security-backports.gemspec
 - test/ruby-cve-2008-3790_test.rb
 - test/ruby-cve-2014-8080_test.rb
+- test/ruby-cve-2014-8090_test.rb
 has_rdoc: true
 homepage: https://github.com/metavida/rails-security-backports
 licenses: 
@@ -83,7 +85,7 @@ rdoc_options:
 - --main
 - README.rdoc
 - --title
-- rails-security-backports-0.0.2
+- rails-security-backports-0.0.3
 - --inline-source
 - --exclude
 - tasks
@@ -118,3 +120,4 @@ summary: Backports of security patches for Ruby & Rails
 test_files: 
 - test/ruby-cve-2008-3790_test.rb
 - test/ruby-cve-2014-8080_test.rb
+- test/ruby-cve-2014-8090_test.rb