ransack 5.0.0 → 5.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0251527dc22cca8cb55ff672b598d74fef0ec4c2b1c6336cb0b8d52d69dabafc
-  data.tar.gz: fd218c05d4697cca5b9a8b4111af7a5fa4ddc559071e9a3194aca2f2b2da6c9d
+  metadata.gz: e1da5ebd35a1352f55541bdc21342c512b6209e385546e8e217c38c4dea79ad5
+  data.tar.gz: 61525c16d6c5e02c57575e72edd28eb9b6376a53bf791e1fda60b2581a95049d
 SHA512:
-  metadata.gz: bc524a7f9a4fac90d6f2e3b9818ccf76bab0f44c872c33db043f049f759f2641c03b338c2cfa28c70a20f6d1d2c4569390e43ec9e5da9daf2537002c519ad3fc
-  data.tar.gz: 3a599c3c9472f0033976ed0301cc0545b62711cccb36817db373c0f19ba0b828640a89bc3784b533346633112fb017353c63c490fa792b3eb3e7aea82f41e527
+  metadata.gz: 0bcdd2aeda080a80a469e591a27b5a4dfa5dadf36b3de1e62a037de661c01e3d8092d4f60d5d458097cace0a1ce87434590a9914651dfd74f899f7d03a144367
+  data.tar.gz: 7aea600100c4ea0001ffed5c84729e950ecb7ccc5421fb853886031585c1a3486377c15facef12c43796a9c5072069972303aa74c868daf24ebfc235e7a49900

data/lib/ransack/adapters/active_record/context.rb

@@ -64,6 +64,8 @@ module Ransack
         end
 
         def attribute_method?(str, klass = @klass)
+          return false unless key_within_depth_limit?(str)
+
           exists = false
           if ransackable_attribute?(str, klass) ||
              ransortable_attribute?(str, klass)
@@ -238,6 +240,8 @@ module Ransack
         end
 
         def get_parent_and_attribute_name(str, parent = @base)
+          return [parent, nil] unless key_within_depth_limit?(str)
+
           attr_name = nil
 
           if ransackable_attribute?(str, klassify(parent)) ||

data/lib/ransack/constants.rb

@@ -50,6 +50,15 @@ module Ransack
 
     DISTINCT = 'DISTINCT '.freeze
 
+    # The most `_`-separated segments a single condition or sort key may have
+    # before Ransack rejects it as invalid instead of parsing it. Working out
+    # whether a key is an attribute, an `_and_`/`_or_` compound or a path
+    # through associations is superlinear in this count, and the key comes
+    # straight from the query string, so an unbounded one is a CPU-exhaustion
+    # denial of service (GHSA-j3f8-w227-4hh8). No real search key is this
+    # long: OR-ing every column of a very wide table stays well under it.
+    MAX_KEY_DEPTH = 200
+
     DERIVED_PREDICATES = [
       [CONT, {
         arel_predicate: 'matches'.freeze,

data/lib/ransack/context.rb

@@ -52,6 +52,15 @@ module Ransack
       @base = @join_dependency.instance_variable_get(:@join_root)
     end
 
+    # False when a key has more `_`-separated segments than Ransack will
+    # parse. The attribute / association / predicate parsing that follows is
+    # superlinear in the segment count and the key is attacker-controlled, so
+    # an over-long key is treated as unknown rather than parsed
+    # (GHSA-j3f8-w227-4hh8).
+    def key_within_depth_limit?(key)
+      key.to_s.count(Constants::UNDERSCORE) <= Constants::MAX_KEY_DEPTH
+    end
+
     def bind_pair_for(key)
       @bind_pairs ||= {}
 
@@ -137,6 +146,8 @@ module Ransack
     end
 
     def association_path(str, base = @base)
+      return ''.freeze unless key_within_depth_limit?(str)
+
       base = klassify(base)
       str ||= ''.freeze
       path = []

data/lib/ransack/nodes/grouping.rb

@@ -126,6 +126,8 @@ module Ransack
       end
 
       def attribute_method?(name)
+        return false unless @context.key_within_depth_limit?(name)
+
         stripped_name = strip_predicate_and_index(name)
         return true if @context.attribute_method?(stripped_name) ||
                        @context.attribute_method?(name)

data/lib/ransack/search.rb

@@ -147,19 +147,31 @@ module Ransack
       @context.chain_scope(key, sanitized_args)
     end
 
+    # The largest position a multiparameter key (`created_at(1i)`) may carry.
+    # Rails' date and time selects emit at most six, year to second. The
+    # position indexes an array, so an unbounded one from a crafted query
+    # string would allocate an array that size (GHSA-vxc9-rm8f-p56j).
+    MULTIPARAMETER_POSITION_LIMIT = 16
+
+    # Folds `created_at(1i)`, `created_at(2i)`, ... into `created_at` as an
+    # array of cast values, the way Active Record does for form input. The
+    # keys are untrusted, so a malformed one is dropped rather than raised
+    # on: no position (`created_at(`), a position outside 1 to the limit,
+    # or a fragment for an attribute that was also given as a plain value.
     def collapse_multiparameter_attributes!(attrs)
       attrs.keys.each do |k|
         if k.include?(Constants::LEFT_PARENTHESIS)
           real_attribute, position = k.split(/\(|\)/)
-          cast =
-          if Constants::A_S_I.include?(position.last)
-            position.last
-          else
-            nil
-          end
-          position = position.to_i - 1
           value = attrs.delete(k)
+          next if position.nil?
+
+          cast = Constants::A_S_I.include?(position.last) ? position.last : nil
+          position = position.to_i - 1
+          next if position < 0 || position >= MULTIPARAMETER_POSITION_LIMIT
+
           attrs[real_attribute] ||= []
+          next unless attrs[real_attribute].is_a?(Array)
+
           attrs[real_attribute][position] =
           if cast
             if value.blank? && cast == Constants::I

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '5.0.0'
+  VERSION = '5.0.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.2
 platform: ruby
 authors:
 - Ernie Miller