sidekiq 7.0.7 → 7.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23b4f6ae3bb1b64fbc6bb359c6d10b52596e3d9c6bae08129907adbaa77f9dd6
-  data.tar.gz: '08590b7d942b48cf050f80236d56957c1ab2b26c37bc94ab07606e5b2be5b4bb'
+  metadata.gz: 69b692f7976998a1655a5c6f108c0a1f686fdcdcde164f6cde071f9ea3f89ced
+  data.tar.gz: d78d581fa48b744789b3af117a55d71bab1037b592f58ee9c74cf2c132716e0c
 SHA512:
-  metadata.gz: 1819631e039de53bc7b1285d6955e89bc8723af0fd6ee64faf3c0d84cd69bc51a6d31ef3f7c6993cd7c937c59993c913c4bba7e3f7a936198081ab2c0af6a499
-  data.tar.gz: a08b785013202849bca3fa61b51757ae413efb5dd459606925107843185881b8b62c8255e1aa7b1e9e3ac44bef69dfc6f1f07d93ffed0029906750850d003061
+  metadata.gz: 42d16710f20a67a94df6498cf1fb5097a8795a5611f058e58d60e43e82503d26871c6d3061b3404590a0e0eba319997cb7e1daec3a88b66c2356e9cc0164a781
+  data.tar.gz: 5b6d9aa7512a67cb552c3a1bed37aa111a877927e7690f53efd3e85aa1ea7049fb75eb05b31232810c8a805f95cb0959a54cc80bafb5c80f9aae0c0701d158b7

data/Changes.md

@@ -2,6 +2,14 @@
 
 [Sidekiq Changes](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/sidekiq/sidekiq/blob/main/Ent-Changes.md)
 
+7.0.8
+----------
+
+- **SECURITY** Sanitize `period` input parameter on Metrics pages.
+  Specially crafted values can lead to XSS. This functionality
+  was introduced in 7.0.4. Thank you to spercex @ huntr.dev [#5694]
+- Add job hash as 3rd parameter to the `sidekiq_retry_in` block.
+
 7.0.7
 ----------
 

data/lib/sidekiq/job_retry.rb

@@ -171,7 +171,7 @@ module Sidekiq
       # Goodbye dear message, you (re)tried your best I'm sure.
       return retries_exhausted(jobinst, msg, exception) if count >= max_retry_attempts
 
-      strategy, delay = delay_for(jobinst, count, exception)
+      strategy, delay = delay_for(jobinst, count, exception, msg)
       case strategy
       when :discard
         return # poof!
@@ -190,12 +190,12 @@ module Sidekiq
     end
 
     # returns (strategy, seconds)
-    def delay_for(jobinst, count, exception)
+    def delay_for(jobinst, count, exception, msg)
       rv = begin
         # sidekiq_retry_in can return two different things:
         # 1. When to retry next, as an integer of seconds
         # 2. A symbol which re-routes the job elsewhere, e.g. :discard, :kill, :default
-        jobinst&.sidekiq_retry_in_block&.call(count, exception)
+        jobinst&.sidekiq_retry_in_block&.call(count, exception, msg)
       rescue Exception => e
         handle_exception(e, {context: "Failure scheduling retry using the defined `sidekiq_retry_in` in #{jobinst.class.name}, falling back to default"})
         nil

data/lib/sidekiq/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "7.0.7"
+  VERSION = "7.0.8"
   MAJOR = 7
 end

data/lib/sidekiq/web/application.rb

@@ -68,7 +68,7 @@ module Sidekiq
 
     get "/metrics" do
       q = Sidekiq::Metrics::Query.new
-      @period = params[:period]
+      @period = h((params[:period] || "")[0..1])
       @periods = METRICS_PERIODS
       minutes = @periods.fetch(@period, @periods.values.first)
       @query_result = q.top_jobs(minutes: minutes)
@@ -77,7 +77,7 @@ module Sidekiq
 
     get "/metrics/:name" do
       @name = route_params[:name]
-      @period = params[:period]
+      @period = h((params[:period] || "")[0..1])
       q = Sidekiq::Metrics::Query.new
       @periods = METRICS_PERIODS
       minutes = @periods.fetch(@period, @periods.values.first)

data/sidekiq.gemspec

@@ -19,7 +19,8 @@ Gem::Specification.new do |gem|
     "bug_tracker_uri" => "https://github.com/sidekiq/sidekiq/issues",
     "documentation_uri" => "https://github.com/sidekiq/sidekiq/wiki",
     "changelog_uri" => "https://github.com/sidekiq/sidekiq/blob/main/Changes.md",
-    "source_code_uri" => "https://github.com/sidekiq/sidekiq"
+    "source_code_uri" => "https://github.com/sidekiq/sidekiq",
+    "rubygems_mfa_required" => "true"
   }
 
   gem.add_dependency "redis-client", ">= 0.11.0"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq
 version: !ruby/object:Gem::Version
-  version: 7.0.7
+  version: 7.0.8
 platform: ruby
 authors:
 - Mike Perham
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-14 00:00:00.000000000 Z
+date: 2023-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis-client
@@ -205,6 +205,7 @@ metadata:
   documentation_uri: https://github.com/sidekiq/sidekiq/wiki
   changelog_uri: https://github.com/sidekiq/sidekiq/blob/main/Changes.md
   source_code_uri: https://github.com/sidekiq/sidekiq
+  rubygems_mfa_required: 'true'
 post_install_message: |2+
 
   Welcome to Sidekiq 7.0!