ransack 4.4.2 → 4.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a52d7bb9b56c22ac02c1d90db283a7b13b0edc867ffae33d6feacb27189ab289
-  data.tar.gz: d28faf9e61c695c770850bde4079e924fc60eb92c1aebdaa02978ae1e9569724
+  metadata.gz: 4de514e3bd66dcd465c8253260a52e8fa9e40476a6e1d12b09dae4ed1ec8aaaf
+  data.tar.gz: 2f156ce6c2bde6adca76eec24e59cf625e2e53b6922d5a0de370d7a1be75354c
 SHA512:
-  metadata.gz: '03959260e88ddaa46d84c6283568fdf0990daf94770db22dc6d9d3fe2ac4735d13d913dae4b02850b885409bc431a420fa53f45299a090d21f9d6330616585fe'
-  data.tar.gz: 3be3468251890fb9be19ab4941d4de0cadf0071f9e561efae9f8727c52ae6216f3b20e18bc2853e516c5c43a4c2a0a6425182ebf9e39fed50e1f6deaf3d1c6e6
+  metadata.gz: f4c4983ce0a10d9afc2f538666f98eeee0eb8f9da168fcd30800ded495cff71807d456e1c462530866d7e5c7954a737fd7127f3badcdb511d48bc9eab22b5d89
+  data.tar.gz: 83403fc8e6cfce559597fa844e0ff79b45623dfd285382a2d0d84547263bd8c95f59998c226b7bd5b4c4745e6d70ddf45c6d5e1fd75c9b7278ae4b09592ef150

data/lib/ransack/adapters/active_record/context.rb

@@ -64,6 +64,8 @@ module Ransack
         end
 
         def attribute_method?(str, klass = @klass)
+          return false unless key_within_depth_limit?(str)
+
           exists = false
           if ransackable_attribute?(str, klass)
             exists = true
@@ -237,6 +239,8 @@ module Ransack
         end
 
         def get_parent_and_attribute_name(str, parent = @base)
+          return [parent, nil] unless key_within_depth_limit?(str)
+
           attr_name = nil
 
           if ransackable_attribute?(str, klassify(parent))

data/lib/ransack/constants.rb

@@ -50,6 +50,15 @@ module Ransack
 
     DISTINCT = 'DISTINCT '.freeze
 
+    # The most `_`-separated segments a single condition or sort key may have
+    # before Ransack rejects it as invalid instead of parsing it. Working out
+    # whether a key is an attribute, an `_and_`/`_or_` compound or a path
+    # through associations is superlinear in this count, and the key comes
+    # straight from the query string, so an unbounded one is a CPU-exhaustion
+    # denial of service (GHSA-j3f8-w227-4hh8). No real search key is this
+    # long: OR-ing every column of a very wide table stays well under it.
+    MAX_KEY_DEPTH = 200
+
     DERIVED_PREDICATES = [
       [CONT, {
         arel_predicate: 'matches'.freeze,

data/lib/ransack/context.rb

@@ -47,6 +47,15 @@ module Ransack
       @base = @join_dependency.instance_variable_get(:@join_root)
     end
 
+    # False when a key has more `_`-separated segments than Ransack will
+    # parse. The attribute / association / predicate parsing that follows is
+    # superlinear in the segment count and the key is attacker-controlled, so
+    # an over-long key is treated as unknown rather than parsed
+    # (GHSA-j3f8-w227-4hh8).
+    def key_within_depth_limit?(key)
+      key.to_s.count(Constants::UNDERSCORE) <= Constants::MAX_KEY_DEPTH
+    end
+
     def bind_pair_for(key)
       @bind_pairs ||= {}
 
@@ -124,6 +133,8 @@ module Ransack
     end
 
     def association_path(str, base = @base)
+      return ''.freeze unless key_within_depth_limit?(str)
+
       base = klassify(base)
       str ||= ''.freeze
       path = []

data/lib/ransack/nodes/grouping.rb

@@ -122,6 +122,8 @@ module Ransack
       end
 
       def attribute_method?(name)
+        return false unless @context.key_within_depth_limit?(name)
+
         stripped_name = strip_predicate_and_index(name)
         return true if @context.attribute_method?(stripped_name) ||
                        @context.attribute_method?(name)

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '4.4.2'
+  VERSION = '4.4.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 4.4.2
+  version: 4.4.3
 platform: ruby
 authors:
 - Ernie Miller