unpoly-rails 3.9.2 → 3.9.2.1

data/lib/unpoly/rails/util.rb

@@ -5,13 +5,19 @@ module Unpoly
 
         def guard_json_decode(raw, &default)
           if raw.present?
-            begin
-              ActiveSupport::JSON.decode(raw)
-            rescue ActiveSupport::JSON.parse_error
-              # We would love to crash here, as it might indicate a bug in the frontend code.
-              # Unfortunately security scanners may be spamming malformed JSON in X-Up headers,
-              # DOSing us with error notifications.
-              ::Rails.logger.error('unpoly-rails: Ignoring malformed JSON in X-Up header')
+            if raw.is_a?(String)
+              begin
+                ActiveSupport::JSON.decode(raw)
+              rescue ActiveSupport::JSON.parse_error
+                # We would love to crash here, as it might indicate a bug in the frontend code.
+                # Unfortunately security scanners may be spamming malformed JSON in X-Up headers,
+                # DOSing us with error notifications.
+                ::Rails.logger.error('unpoly-rails: Ignoring malformed JSON in X-Up header')
+                default&.call
+              end
+            else
+              # Security spammers may pass nested param values in params like _up_context_changes.
+              ::Rails.logger.error('unpoly-rails: Ignoring nested value in _up param')
               default&.call
             end
           else

data/lib/unpoly/rails/version.rb

@@ -3,6 +3,6 @@ module Unpoly
     ##
     # The current version of the unpoly-rails gem.
     # The first 3 digits should match the version of the Unpoly frontend code.
-    VERSION = '3.9.2'
+    VERSION = '3.9.2.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unpoly-rails
 version: !ruby/object:Gem::Version
-  version: 3.9.2
+  version: 3.9.2.1
 platform: ruby
 authors:
 - Henning Koch
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-04 00:00:00.000000000 Z
+date: 2024-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties