ransack 6.0.0 → 6.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab7bd0c932988849a454c8178e7676022783c3bddb36f8e8d951c11aaf24de7c
-  data.tar.gz: c076572a9ea5b4084fe9754bfc53cdcfa33667f8b2837ed1880fc11c1b855345
+  metadata.gz: 9940472d0658f87581dd23a9668c17b557806f72735ed8e66ceef5332c099d8b
+  data.tar.gz: 576b1c827db6b63a08d980c91fd063eee4b5bbdb359503a9c4af0bacfc134cfe
 SHA512:
-  metadata.gz: 01de2b357a7c9f782d5e3ca9fb705ef4ccbd0b01a291fd90537903f2d514b4da3734fc6fba0425e9b908b78d2c073ba1cfde886c22f55432c68b739b14dc7336
-  data.tar.gz: e3f13fdd795a2bfd0b37a4d7788ea9437f445c05a25185bc22e1e85efa84e0bbe47d63613d09f9d7b3690a75e9ccf05bcec63944e3804436de97247c230b3834
+  metadata.gz: 173aab57088df1db09eff37d4e3098ebbb18042fe387ab151958d7d5a892481bbfffc2cd35b1934f87e015c79bdd60f53d3be6a1828e9d541cda76725947a19e
+  data.tar.gz: 759843af14c0312b0167661a6e650bf933da0cb8ee652ad381452b7509f9e348f59c4a45fa274f6f0364bb78e48a142e171788039fd8f9690e50200108f8c1f3

data/lib/ransack/helpers/form_helper.rb

@@ -162,6 +162,17 @@ module Ransack
         end
 
       class SortLink
+        # Keys url_for reads as instructions for building the link, not as
+        # query params. The request's params are carried over into the link,
+        # so a crafted query string could otherwise change its scheme, host,
+        # port, path prefix or route (GHSA-58rx-96gf-w92x). Userinfo needs
+        # :user and :password together, so dropping :password is enough to
+        # keep a ?user= filter.
+        RESERVED_URL_OPTIONS = (
+          ActionDispatch::Routing::RouteSet::RESERVED_OPTIONS +
+          %i[password use_route _recall]
+        ).freeze
+
         def initialize(search, attribute, args, params)
           @search         = search
           @params         = parameters_hash(params)
@@ -195,7 +206,7 @@ module Ransack
         end
 
         def url_options
-          @params.except(:host).merge(
+          @params.except(*RESERVED_URL_OPTIONS).merge(
             @options.except(:class, :data, :host).merge(
               @search.context.search_key => search_and_sort_params))
         end
@@ -218,12 +229,11 @@ module Ransack
 
         private
 
+          # Indifferent access, so RESERVED_URL_OPTIONS also matches the string
+          # keys of a plain Hash.
           def parameters_hash(params)
-            if params.respond_to?(:to_unsafe_h)
-              params.to_unsafe_h
-            else
-              params
-            end
+            params = params.to_unsafe_h if params.respond_to?(:to_unsafe_h)
+            params.with_indifferent_access
           end
 
           def extract_sort_fields_and_mutate_args!(args)

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '6.0.0'
+  VERSION = '6.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 6.0.0
+  version: 6.0.1
 platform: ruby
 authors:
 - Ernie Miller