Ruby/actionview/4.2.4.rc1
Simple, battle-tested conventions and helpers for building web pages.
https://rubygems.org/gems/actionview
MIT
17 Security Vulnerabilities
Cross site scripting vulnerability in ActionView
- https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
- https://nvd.nist.gov/vuln/detail/CVE-2020-5267
- https://github.com/advisories/GHSA-65cv-r6x7-79hv
- https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
- https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html
- http://www.openwall.com/lists/oss-security/2020/03/19/1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-5267.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j
or escape_javascript
methods may be susceptible to XSS attacks.
Impact
There is a possible XSS vulnerability in the j
and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:
<script>let a = `<%= j unknown_input %>`</script>
or
<script>let a = `<%= escape_javascript unknown_input %>`</script>
Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
For those that can't upgrade, the following monkey patch may be used:
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-js-helper-xss.patch - Patch for 5.2 series
- 6-0-js-helper-xss.patch - Patch for 6.0 series
Please note that only the 5.2 and 6.0 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thanks to Jesse Campos from Chef Secure
Moderate severity vulnerability that affects actionview
Withdrawn, accidental duplicate publish.
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Path Traversal in Action View
- https://groups.google.com/forum/#!topic/rubyonrails-security/zRNVOUhKHrg
- https://nvd.nist.gov/vuln/detail/CVE-2019-5418
- https://github.com/advisories/GHSA-86g5-2wh3-gc9j
- https://access.redhat.com/errata/RHSA-2019:0796
- https://access.redhat.com/errata/RHSA-2019:1147
- https://access.redhat.com/errata/RHSA-2019:1149
- https://access.redhat.com/errata/RHSA-2019:1289
- https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://www.exploit-db.com/exploits/46585/
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
- http://www.openwall.com/lists/oss-security/2019/03/22/1
File Content Disclosure in Action View
Impact
There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file:
can cause arbitrary files on the target server to be rendered, disclosing the file contents.
The impact is limited to calls to render
which render file contents without a specified accept format. Impacted code in a controller looks something like this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file"
end
end
Rendering templates as opposed to files is not impacted by this vulnerability.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds
This vulnerability can be mitigated by specifying a format for file rendering, like this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file", formats: [:html]
end
end
In summary, impacted calls to render
look like this:
render file: "#{Rails.root}/some/file"
The vulnerability can be mitigated by changing to this:
render file: "#{Rails.root}/some/file", formats: [:html]
Other calls to render
are not impacted.
Alternatively, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
XSS in Action View
- https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5
- https://nvd.nist.gov/vuln/detail/CVE-2020-15169
- https://github.com/advisories/GHSA-cfjv-5498-mph5
- https://github.com/rails/rails/commit/e663f084460ea56c55c3dc76f78c7caeddeeb02e
- https://www.debian.org/security/2020/dsa-4766
- https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-15169.yml
- https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t
and translate
helpers could be susceptible to XSS attacks.
Impact
When an HTML-unsafe string is passed as the default for a missing translation key named html
or ending in _html
, the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>
<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
Patches
Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.
The patches have also been applied to the master
, 6-0-stable
, and 5-2-stable
branches on GitHub. If you track any of these branches, you should update to the latest.
To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-translate-helper-xss.patch — patch for the 5.2 release series
- 6-0-translate-helper-xss.patch — patch for the 6.0 release series
Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.
Workarounds
Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the html_escape
helper (aliased as h
):
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
XSS Vulnerability in Action View tag helpers
- https://nvd.nist.gov/vuln/detail/CVE-2022-27777
- https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
- https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
- https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
- https://github.com/advisories/GHSA-ch3h-j2vf-95pv
- https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://www.debian.org/security/2023/dsa-5372
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.
Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.
Impacted code will look something like this:
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
Where the malicious_input
variable contains untrusted data.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Escape the untrusted data before using it as a key for tag helper methods.
Remote code execution via user-provided local names in ActionView
- https://nvd.nist.gov/vuln/detail/CVE-2020-8163
- https://github.com/advisories/GHSA-cr3x-7m39-c6jq
- https://hackerone.com/reports/304805
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
- https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals
argument of a render
call to perform a RCE.
Denial of Service Vulnerability in Action View
- https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
- https://nvd.nist.gov/vuln/detail/CVE-2019-5419
- https://github.com/advisories/GHSA-m63j-wh5w-c252
- https://access.redhat.com/errata/RHSA-2019:0796
- https://access.redhat.com/errata/RHSA-2019:1147
- https://access.redhat.com/errata/RHSA-2019:1149
- https://access.redhat.com/errata/RHSA-2019:1289
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/03/22/1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2019-5419.yml
- https://github.com/rails/rails/pull/35708
- https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715
Denial of Service Vulnerability in Action View
Impact
Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds
This vulnerability can be mitigated by wrapping render
calls with respond_to
blocks. For example, the following example is vulnerable:
class UserController < ApplicationController
def index
render "index"
end
end
But the following code is not vulnerable:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Implicit rendering is impacted, so this code is vulnerable:
class UserController < ApplicationController
def index
end
end
But can be changed this this:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Alternatively to specifying the format, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Also note that the patches for this vulnerability are the same as CVE-2019-5418.
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
actionview Cross-site Scripting vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2016-6316
- https://github.com/advisories/GHSA-pc3m-v286-2jwj
- https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE
- https://puppet.com/security/cve/cve-2016-6316
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://rhn.redhat.com/errata/RHSA-2016-1856.html
- http://rhn.redhat.com/errata/RHSA-2016-1857.html
- http://rhn.redhat.com/errata/RHSA-2016-1858.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
- http://www.debian.org/security/2016/dsa-3651
- http://www.openwall.com/lists/oss-security/2016/08/11/3
- http://www.securityfocus.com/bid/92430
- https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
- https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-6316.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as HTML safe
and used as attribute values in tag handlers.
Directory traversal vulnerability in Action View in Ruby on Rails
- https://nvd.nist.gov/vuln/detail/CVE-2016-0752
- https://github.com/advisories/GHSA-xrr4-p6fq-hjg7
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
- https://www.exploit-db.com/exploits/40561/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- http://rhn.redhat.com/errata/RHSA-2016-0296.html
- http://www.debian.org/security/2016/dsa-3464
- http://www.openwall.com/lists/oss-security/2016/01/25/13
- http://www.securityfocus.com/bid/81801
- http://www.securitytracker.com/id/1034816
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-0752.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-0752.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
- https://web.archive.org/web/20210618005620/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
- https://web.archive.org/web/20210621170450/http://www.securityfocus.com/bid/81801
- https://web.archive.org/web/20210723192420/http://www.securitytracker.com/id/1034816
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a ..
(dot dot) in a pathname.
Possible Information Leak Vulnerability in Action View
There is a possible directory traversal and information leak vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2016-0752.
Versions Affected: All. Not affected: None. Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
Impact
Applications that pass unverified user input to the render
method in a
controller may be vulnerable to an information leak vulnerability.
Impacted code will look something like this:
def index
render params[:id]
end
Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
A workaround to this issue is to not pass arbitrary user input to the render
method. Instead, verify that data before passing it to the render
method.
For example, change this:
def index
render params[:id]
end
To this:
def index
render verify_template(params[:id])
end
private
def verify_template(name)
# add verification logic particular to your application here
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 3-2-renderdataleak.patch - Patch for 3.2 series
- 4-1-renderdataleak.patch - Patch for 4.1 series
- 4-2-renderdataleak.patch - Patch for 4.2 series
- 5-0-renderdataleak.patch - Patch for 5.0 series
Please note that only the 4.1.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thanks John Poulin for reporting this!
File Content Disclosure in Action View
There is a possible file content disclosure vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2019-5418.
Versions Affected: All. Not affected: None. Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1
Impact
There is a possible file content disclosure vulnerability in Action View.
Specially crafted accept headers in combination with calls to render file:
can cause arbitrary files on the target server to be rendered, disclosing the
file contents.
The impact is limited to calls to render
which render file contents without
a specified accept format. Impacted code in a controller looks something like
this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file"
end
end
Rendering templates as opposed to files is not impacted by this vulnerability.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds
This vulnerability can be mitigated by specifying a format for file rendering, like this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file", formats: [:html]
end
end
In summary, impacted calls to render
look like this:
render file: "#{Rails.root}/some/file"
The vulnerability can be mitigated by changing to this:
render file: "#{Rails.root}/some/file", formats: [:html]
Other calls to render
are not impacted.
Alternatively, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
Denial of Service Vulnerability in Action View
There is a potential denial of service vulnerability in actionview. This vulnerability has been assigned the CVE identifier CVE-2019-5419.
Impact
Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
This vulnerability can be mitigated by wrapping render
calls with
respond_to
blocks. For example, the following example is vulnerable:
class UserController < ApplicationController
def index
render "index"
end
end
But the following code is not vulnerable:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Implicit rendering is impacted, so this code is vulnerable:
class UserController < ApplicationController
def index
end
end
But can be changed this this:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Alternatively to specifying the format, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
Potential XSS vulnerability in Action View
There is a potential Cross-Site Scripting (XSS) vulnerability in Action
View's translation helpers. Views that allow the user to control the
default (not found) value of the t
and translate
helpers could be
susceptible to XSS attacks.
Impact
When an HTML-unsafe string is passed as the default for a missing
translation key named html
or ending in _html
,
the default string is incorrectly marked as HTML-safe and not escaped.
Vulnerable code may look like the following examples:
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>
<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
Workarounds
Impacted users who can’t upgrade to a patched Rails version can avoid
this issue by manually escaping default translations with the
html_escape
helper (aliased as h
):
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
Possible XSS vulnerability in ActionView
There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the j
or escape_javascript
methods
may be susceptible to XSS attacks.
Versions Affected: All. Not affected: None. Fixed Versions: 6.0.2.2, 5.2.4.2
Impact
There is a possible XSS vulnerability in the j
and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:
<script>let a = `<%= j unknown_input %>`</script>
or
<script>let a = `<%= escape_javascript unknown_input %>`</script>
Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
For those that can't upgrade, the following monkey patch may be used:
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
Potential remote code execution of user-provided local names in ActionView
There was a vulnerability in versions of Rails prior to 5.0.1 that would
allow an attacker who controlled the locals
argument of a render
call.
Versions Affected: rails < 5.0.1 Not affected: Applications that do not allow users to control the names of locals. Fixed Versions: 4.2.11.2
Impact
In the scenario where an attacker might be able to control the name of a
local passed into render
, they can acheive remote code execution.
Workarounds
Until such time as the patch can be applied, application developers should ensure that all user-provided local names are alphanumeric.
CSRF Vulnerability in rails-ujs
There is an vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.
Versions Affected: rails <= 6.0.3 Not affected: Applications which don't use rails-ujs. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
This is a regression of CVE-2015-1840.
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# Filter just the parameters that you trust
end
Possible XSS Vulnerability in Action View tag helpers
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.
Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.
Impacted code will look something like this:
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
Where the malicious_input
variable contains untrusted data.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Escape the untrusted data before using it as a key for tag helper methods.
257 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
6.0.0.beta2 | MIT | 9 | 2019-02-25 - 22:45 | about 5 years |
6.0.0.beta1 | MIT | 9 | 2019-01-18 - 20:43 | over 5 years |
5.2.8.1 | MIT | 2 | 2022-07-12 - 17:26 | almost 2 years |
5.2.8 | MIT | 2 | 2022-05-09 - 13:58 | about 2 years |
5.2.7.1 | MIT | 2 | 2022-04-26 - 19:23 | about 2 years |
5.2.7 | MIT | 4 | 2022-03-11 - 00:00 | about 2 years |
5.2.6.3 | MIT | 4 | 2022-03-08 - 17:45 | about 2 years |
5.2.6.2 | MIT | 4 | 2022-02-11 - 19:37 | over 2 years |
5.2.6.1 | MIT | 4 | 2022-02-11 - 18:38 | over 2 years |
5.2.6 | MIT | 4 | 2021-05-05 - 17:03 | about 3 years |
5.2.5 | MIT | 4 | 2021-03-26 - 17:17 | about 3 years |
5.2.4.6 | MIT | 4 | 2021-05-05 - 15:28 | about 3 years |
5.2.4.5 | MIT | 4 | 2021-02-10 - 20:34 | over 3 years |
5.2.4.4 | MIT | 4 | 2020-09-09 - 18:36 | over 3 years |
5.2.4.3 | MIT | 6 | 2020-05-18 - 15:42 | about 4 years |
5.2.4.2 | MIT | 8 | 2020-03-19 - 16:31 | about 4 years |
5.2.4.1 | MIT | 10 | 2019-12-18 - 19:01 | over 4 years |
5.2.4 | MIT | 10 | 2019-11-27 - 15:45 | over 4 years |
5.2.4.rc1 | MIT | 10 | 2019-11-23 - 00:26 | over 4 years |
5.2.3 | MIT | 10 | 2019-03-28 - 03:01 | about 5 years |
5.2.3.rc1 | MIT | 10 | 2019-03-22 - 03:34 | about 5 years |
5.2.2.1 | MIT | 10 | 2019-03-13 - 16:47 | about 5 years |
5.2.2 | MIT | 14 | 2018-12-04 - 18:12 | over 5 years |
5.2.2.rc1 | MIT | 14 | 2018-11-28 - 22:52 | over 5 years |
5.2.1.1 | MIT | 14 | 2018-11-27 - 20:13 | over 5 years |
5.2.1 | MIT | 14 | 2018-08-07 - 21:43 | almost 6 years |
5.2.1.rc1 | MIT | 14 | 2018-07-30 - 20:14 | almost 6 years |
5.2.0 | MIT | 14 | 2018-04-09 - 20:05 | about 6 years |
5.2.0.rc2 | MIT | 12 | 2018-03-20 - 17:50 | about 6 years |
5.2.0.rc1 | MIT | 12 | 2018-01-30 - 23:36 | over 6 years |
5.2.0.beta2 | MIT | 12 | 2017-11-28 - 05:02 | over 6 years |
5.2.0.beta1 | MIT | 12 | 2017-11-27 - 18:03 | over 6 years |
5.1.7 | MIT | 10 | 2019-03-28 - 02:47 | about 5 years |
5.1.7.rc1 | MIT | 10 | 2019-03-22 - 04:12 | about 5 years |
5.1.6.2 | MIT | 10 | 2019-03-13 - 16:45 | about 5 years |
5.1.6.1 | MIT | 14 | 2018-11-27 - 20:10 | over 5 years |
5.1.6 | MIT | 14 | 2018-03-29 - 18:28 | about 6 years |
5.1.5 | MIT | 14 | 2018-02-14 - 19:54 | over 6 years |
5.1.5.rc1 | MIT | 14 | 2018-02-01 - 18:58 | over 6 years |
5.1.4 | MIT | 14 | 2017-09-08 - 00:50 | over 6 years |
5.1.4.rc1 | MIT | 14 | 2017-08-24 - 19:36 | over 6 years |
5.1.3 | MIT | 14 | 2017-08-03 - 19:14 | almost 7 years |
5.1.3.rc3 | MIT | 14 | 2017-07-31 - 19:11 | almost 7 years |
5.1.3.rc2 | MIT | 14 | 2017-07-25 - 20:17 | almost 7 years |
5.1.3.rc1 | MIT | 14 | 2017-07-19 - 19:32 | almost 7 years |
5.1.2 | MIT | 14 | 2017-06-26 - 21:50 | almost 7 years |
5.1.2.rc1 | MIT | 14 | 2017-06-20 - 17:02 | almost 7 years |
5.1.1 | MIT | 14 | 2017-05-12 - 20:10 | about 7 years |
5.1.0 | MIT | 14 | 2017-04-27 - 20:59 | about 7 years |
5.1.0.rc2 | MIT | 10 | 2017-04-21 - 01:29 | about 7 years |
5.1.0.rc1 | MIT | 10 | 2017-03-20 - 18:56 | about 7 years |
5.1.0.beta1 | MIT | 10 | 2017-02-23 - 19:55 | about 7 years |
5.0.7.2 | MIT | 8 | 2019-03-13 - 16:40 | about 5 years |
5.0.7.1 | MIT | 12 | 2018-11-27 - 20:08 | over 5 years |
5.0.7 | MIT | 12 | 2018-03-29 - 17:58 | about 6 years |
5.0.6 | MIT | 12 | 2017-09-08 - 00:46 | over 6 years |
5.0.6.rc1 | MIT | 12 | 2017-08-24 - 19:10 | over 6 years |
5.0.5 | MIT | 12 | 2017-07-31 - 19:04 | almost 7 years |
5.0.5.rc2 | MIT | 12 | 2017-07-25 - 20:25 | almost 7 years |
5.0.5.rc1 | MIT | 12 | 2017-07-19 - 19:42 | almost 7 years |
5.0.4 | MIT | 12 | 2017-06-19 - 21:57 | almost 7 years |
5.0.4.rc1 | MIT | 12 | 2017-06-14 - 20:48 | almost 7 years |
5.0.3 | MIT | 12 | 2017-05-12 - 20:03 | about 7 years |
5.0.2 | MIT | 12 | 2017-03-01 - 23:12 | about 7 years |
5.0.2.rc1 | MIT | 12 | 2017-02-25 - 00:54 | about 7 years |
5.0.1 | MIT | 12 | 2016-12-21 - 00:06 | over 7 years |
5.0.1.rc2 | MIT | 12 | 2016-12-09 - 19:12 | over 7 years |
5.0.1.rc1 | MIT | 12 | 2016-11-30 - 20:01 | over 7 years |
5.0.0.1 | MIT | 12 | 2016-08-11 - 17:32 | almost 8 years |
5.0.0 | MIT | 14 | 2016-06-30 - 21:21 | almost 8 years |
5.0.0.rc2 | MIT | 10 | 2016-06-22 - 20:02 | almost 8 years |
5.0.0.rc1 | MIT | 10 | 2016-05-06 - 21:56 | about 8 years |
5.0.0.beta4 | MIT | 10 | 2016-04-27 - 20:54 | about 8 years |
5.0.0.beta3 | MIT | 10 | 2016-02-24 - 16:15 | about 8 years |
5.0.0.beta2 | MIT | 10 | 2016-02-01 - 22:05 | over 8 years |
5.0.0.beta1.1 | MIT | 10 | 2016-01-25 - 19:24 | over 8 years |
5.0.0.beta1 | MIT | 10 | 2015-12-18 - 21:17 | over 8 years |
5.0.0.racecar1 | MIT | 11 | 2016-05-06 - 22:01 | about 8 years |
4.2.11.3 | MIT | 7 | 2020-05-15 - 18:35 | about 4 years |
4.2.11.2 | MIT | 7 | 2020-05-15 - 16:30 | about 4 years |
4.2.11.1 | MIT | 9 | 2019-03-13 - 16:37 | about 5 years |
4.2.11 | MIT | 13 | 2018-11-27 - 20:06 | over 5 years |
4.2.10 | MIT | 13 | 2017-09-27 - 14:28 | over 6 years |
4.2.10.rc1 | MIT | 13 | 2017-09-20 - 19:41 | over 6 years |
4.2.9 | MIT | 13 | 2017-06-26 - 21:30 | almost 7 years |
4.2.9.rc2 | MIT | 13 | 2017-06-19 - 22:27 | almost 7 years |
4.2.9.rc1 | MIT | 13 | 2017-06-13 - 18:49 | almost 7 years |
4.2.8 | MIT | 13 | 2017-02-21 - 16:08 | about 7 years |
4.2.8.rc1 | MIT | 13 | 2017-02-10 - 02:45 | over 7 years |
4.2.7.1 | MIT | 13 | 2016-08-11 - 17:32 | almost 8 years |
4.2.7 | MIT | 14 | 2016-07-13 - 02:55 | almost 8 years |
4.2.7.rc1 | MIT | 14 | 2016-07-01 - 00:31 | almost 8 years |
4.2.6 | MIT | 14 | 2016-03-07 - 22:32 | about 8 years |
4.2.6.rc1 | MIT | 14 | 2016-03-01 - 18:37 | about 8 years |
4.2.5.2 | MIT | 14 | 2016-02-29 - 19:16 | about 8 years |
4.2.5.1 | MIT | 14 | 2016-01-25 - 19:24 | over 8 years |
4.2.5 | MIT | 17 | 2015-11-12 - 17:06 | over 8 years |
4.2.5.rc2 | MIT | 17 | 2015-11-05 - 03:01 | over 8 years |
4.2.5.rc1 | MIT | 17 | 2015-10-30 - 20:47 | over 8 years |
4.2.4 | MIT | 17 | 2015-08-24 - 18:25 | over 8 years |