From 0f3b7d1a319383f743f9938e1eed00f0fba7a367 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?= Date: Thu, 17 Apr 2014 16:50:39 -0300 Subject: [PATCH 1/3] Only accept actions without File::SEPARATOR in the name. This will avoid directory traversal in implicit render. Fixes: CVE-2014-0130 --- actionpack/lib/abstract_controller/base.rb | 28 +++++++++++++++++-- .../new_base/render_implicit_action_test.rb | 17 ++++++++++- 2 files changed, 41 insertions(+), 4 deletions(-) diff --git a/actionpack/lib/abstract_controller/base.rb b/actionpack/lib/abstract_controller/base.rb index fd6a46fbec..2541125ec6 100644 --- a/actionpack/lib/abstract_controller/base.rb +++ b/actionpack/lib/abstract_controller/base.rb @@ -112,7 +112,7 @@ module AbstractController def process(action, *args) @_action_name = action_name = action.to_s - unless action_name = method_for_action(action_name) + unless action_name = _find_action_name(action_name) raise ActionNotFound, "The action '#{action}' could not be found for #{self.class.name}" end @@ -138,7 +138,7 @@ module AbstractController # available action consider actions that are also available # through other means, for example, implicit render ones. def available_action?(action_name) - method_for_action(action_name).present? + _find_action_name(action_name).present? end private @@ -181,6 +181,23 @@ module AbstractController action_missing(@_action_name, *args) end + # Takes an action name and returns the name of the method that will + # handle the action. + # + # It checks if the action name is valid and returns false otherwise. + # + # See method_for_action for more information. + # + # ==== Parameters + # * action_name - An action name to find a method name for + # + # ==== Returns + # * string - The name of the method that handles the action + # * false - No valid method name could be found. Raise ActionNotFound. + def _find_action_name(action_name) + _valid_action_name?(action_name) && method_for_action(action_name) + end + # Takes an action name and returns the name of the method that will # handle the action. In normal cases, this method returns the same # name as it receives. By default, if #method_for_action receives @@ -203,11 +220,16 @@ module AbstractController # # ==== Returns # * string - The name of the method that handles the action - # * nil - No method name could be found. Raise ActionNotFound. + # * nil - No method name could be found. def method_for_action(action_name) if action_method?(action_name) then action_name elsif respond_to?(:action_missing, true) then "_handle_action_missing" end end + + # Checks if the action name is valid and returns false otherwise. + def _valid_action_name?(action_name) + action_name.to_s !~ Regexp.new(File::SEPARATOR) + end end end diff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb index 1e2191d417..5b4885f7e0 100644 --- a/actionpack/test/controller/new_base/render_implicit_action_test.rb +++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb @@ -6,7 +6,7 @@ module RenderImplicitAction "render_implicit_action/simple/hello_world.html.erb" => "Hello world!", "render_implicit_action/simple/hyphen-ated.html.erb" => "Hello hyphen-ated!", "render_implicit_action/simple/not_implemented.html.erb" => "Not Implemented" - )] + ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))] def hello_world() end end @@ -33,10 +33,25 @@ module RenderImplicitAction assert_status 200 end + test "render does not traverse the file system" do + assert_raises(AbstractController::ActionNotFound) do + action_name = %w(.. .. fixtures shared).join(File::SEPARATOR) + SimpleController.action(action_name).call(Rack::MockRequest.env_for("/")) + end + end + test "available_action? returns true for implicit actions" do assert SimpleController.new.available_action?(:hello_world) assert SimpleController.new.available_action?(:"hyphen-ated") assert SimpleController.new.available_action?(:not_implemented) end + + test "available_action? does not allow File::SEPARATOR on the name" do + action_name = %w(evil .. .. path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + + action_name = %w(evil path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + end end end From 4e8f1d258854d0d6a6bff5955ef1aeb4fbb1dc00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?= Date: Mon, 5 May 2014 13:17:18 -0300 Subject: [PATCH 2/3] Preparing for 3.2.18 release --- RAILS_VERSION | 2 +- actionmailer/CHANGELOG.md | 15 +++++++++++++++ actionmailer/lib/action_mailer/version.rb | 2 +- actionpack/CHANGELOG.md | 14 ++++++++++++++ actionpack/lib/action_pack/version.rb | 2 +- activemodel/CHANGELOG.md | 15 +++++++++++++++ activemodel/lib/active_model/version.rb | 2 +- activerecord/CHANGELOG.md | 15 +++++++++++++++ activerecord/lib/active_record/version.rb | 2 +- activeresource/CHANGELOG.md | 16 ++++++++++++++++ activeresource/lib/active_resource/version.rb | 2 +- activesupport/CHANGELOG.md | 15 +++++++++++++++ activesupport/lib/active_support/version.rb | 2 +- railties/CHANGELOG.md | 16 ++++++++++++++++ railties/lib/rails/version.rb | 2 +- version.rb | 2 +- 16 files changed, 115 insertions(+), 9 deletions(-) diff --git a/RAILS_VERSION b/RAILS_VERSION index ff8001a0f1..f05489d385 100644 --- a/RAILS_VERSION +++ b/RAILS_VERSION @@ -1 +1 @@ -3.2.17 +3.2.18 diff --git a/actionmailer/CHANGELOG.md b/actionmailer/CHANGELOG.md index b8c375306e..94d3f54bea 100644 --- a/actionmailer/CHANGELOG.md +++ b/actionmailer/CHANGELOG.md @@ -1,3 +1,18 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * No changes. diff --git a/actionmailer/lib/action_mailer/version.rb b/actionmailer/lib/action_mailer/version.rb index e33d01ac4c..8212a9b108 100644 --- a/actionmailer/lib/action_mailer/version.rb +++ b/actionmailer/lib/action_mailer/version.rb @@ -2,7 +2,7 @@ module ActionMailer module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index 6269123de3..1264e859b3 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -1,3 +1,16 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* Only accept actions without File::SEPARATOR in the name. + + This will avoid directory traversal in implicit render. + + Fixes: CVE-2014-0130 + + *Rafael Mendonça França* + + +## Rails 3.2.17 (Feb 18, 2014) ## + * Use the reference for the mime type to get the format Fixes: CVE-2014-0082 @@ -6,6 +19,7 @@ Fixes: CVE-2014-0081 + ## Rails 3.2.16 (Dec 12, 2013) ## * Deep Munge the parameters for GET and POST Fixes CVE-2013-6417 diff --git a/actionpack/lib/action_pack/version.rb b/actionpack/lib/action_pack/version.rb index 4d278814c8..ac6d3343b9 100644 --- a/actionpack/lib/action_pack/version.rb +++ b/actionpack/lib/action_pack/version.rb @@ -2,7 +2,7 @@ module ActionPack module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/activemodel/CHANGELOG.md b/activemodel/CHANGELOG.md index 7db08549d9..fb4bfda149 100644 --- a/activemodel/CHANGELOG.md +++ b/activemodel/CHANGELOG.md @@ -1,3 +1,18 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * No changes. diff --git a/activemodel/lib/active_model/version.rb b/activemodel/lib/active_model/version.rb index 08d437cbc2..e675c7454c 100644 --- a/activemodel/lib/active_model/version.rb +++ b/activemodel/lib/active_model/version.rb @@ -2,7 +2,7 @@ module ActiveModel module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md index 878e5eeebc..6ac368f379 100644 --- a/activerecord/CHANGELOG.md +++ b/activerecord/CHANGELOG.md @@ -1,3 +1,18 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * When calling the method .find_or_initialize_by_* from a collection_proxy diff --git a/activerecord/lib/active_record/version.rb b/activerecord/lib/active_record/version.rb index cced9eae8f..3dd782af9f 100644 --- a/activerecord/lib/active_record/version.rb +++ b/activerecord/lib/active_record/version.rb @@ -2,7 +2,7 @@ module ActiveRecord module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/activeresource/CHANGELOG.md b/activeresource/CHANGELOG.md index c1f0fa3403..4a555cf6b8 100644 --- a/activeresource/CHANGELOG.md +++ b/activeresource/CHANGELOG.md @@ -1,7 +1,23 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * No changes. + ## Rails 3.2.14 (Jul 22, 2013) ## * Fixes an issue that ActiveResource models ignores ActiveResource::Base.include_root_in_json. diff --git a/activeresource/lib/active_resource/version.rb b/activeresource/lib/active_resource/version.rb index ea9b7a51e9..dee96b8fd8 100644 --- a/activeresource/lib/active_resource/version.rb +++ b/activeresource/lib/active_resource/version.rb @@ -2,7 +2,7 @@ module ActiveResource module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md index 29f7db53eb..e22aded195 100644 --- a/activesupport/CHANGELOG.md +++ b/activesupport/CHANGELOG.md @@ -1,3 +1,18 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * Fix ActiveSupport::Cache::FileStore#cleanup to no longer rely on missing each_key method. diff --git a/activesupport/lib/active_support/version.rb b/activesupport/lib/active_support/version.rb index 95faab1dd6..10c9fca86c 100644 --- a/activesupport/lib/active_support/version.rb +++ b/activesupport/lib/active_support/version.rb @@ -2,7 +2,7 @@ module ActiveSupport module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md index 3e075a8f9f..ce832d12ee 100644 --- a/railties/CHANGELOG.md +++ b/railties/CHANGELOG.md @@ -1,7 +1,23 @@ +## Rails 3.2.18 (May 6, 2014) ## + +* No changes. + + +## Rails 3.2.17 (Feb 18, 2014) ## + +* No changes. + + +## Rails 3.2.16 (Dec 3, 2013) ## + +* No changes. + + ## Rails 3.2.15 (Oct 16, 2013) ## * No changes. + ## Rails 3.2.14 (Jul 22, 2013) ## * Fix bugs that crashed `rake test:benchmark`, `rails profiler` and diff --git a/railties/lib/rails/version.rb b/railties/lib/rails/version.rb index 38890e162d..ec2f5467f0 100644 --- a/railties/lib/rails/version.rb +++ b/railties/lib/rails/version.rb @@ -2,7 +2,7 @@ module Rails module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') diff --git a/version.rb b/version.rb index 38890e162d..ec2f5467f0 100644 --- a/version.rb +++ b/version.rb @@ -2,7 +2,7 @@ module Rails module VERSION #:nodoc: MAJOR = 3 MINOR = 2 - TINY = 17 + TINY = 18 PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') From 50d6b4549d56ac3a82f2096bd479a7b2305b0bf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?= Date: Tue, 6 May 2014 11:41:30 -0300 Subject: [PATCH 3/3] Fix broken tests of the previous release --- Gemfile | 2 +- actionpack/test/template/number_helper_i18n_test.rb | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Gemfile b/Gemfile index 8c5cbb2ab1..633444212b 100644 --- a/Gemfile +++ b/Gemfile @@ -22,7 +22,7 @@ end gem 'uglifier', '>= 1.0.3', :require => false gem 'rake', '>= 0.8.7' -gem 'mocha', '>= 0.13.0', :require => false +gem 'mocha', '~> 0.14', :require => false group :doc do # The current sdoc cannot generate GitHub links due diff --git a/actionpack/test/template/number_helper_i18n_test.rb b/actionpack/test/template/number_helper_i18n_test.rb index d6e9de9555..5a3250e949 100644 --- a/actionpack/test/template/number_helper_i18n_test.rb +++ b/actionpack/test/template/number_helper_i18n_test.rb @@ -7,7 +7,7 @@ class NumberHelperTest < ActionView::TestCase I18n.backend.store_translations 'ts', :number => { :format => { :precision => 3, :delimiter => ',', :separator => '.', :significant => false, :strip_insignificant_zeros => false }, - :currency => { :format => { :unit => '&$', :format => '%u - %n', :negative_format => '(%u - %n)', :precision => 2 } }, + :currency => { :format => { :unit => '$$$', :format => '%u - %n', :negative_format => '(%u - %n)', :precision => 2 } }, :human => { :format => { :precision => 2, @@ -42,9 +42,9 @@ class NumberHelperTest < ActionView::TestCase end def test_number_to_i18n_currency - assert_equal("&$ - 10.00", number_to_currency(10, :locale => 'ts')) - assert_equal("(&$ - 10.00)", number_to_currency(-10, :locale => 'ts')) - assert_equal("-10.00 - &$", number_to_currency(-10, :locale => 'ts', :format => "%n - %u")) + assert_equal("$$$ - 10.00", number_to_currency(10, :locale => 'ts')) + assert_equal("($$$ - 10.00)", number_to_currency(-10, :locale => 'ts')) + assert_equal("-10.00 - $$$", number_to_currency(-10, :locale => 'ts', :format => "%n - %u")) end def test_number_to_currency_with_clean_i18n_settings @@ -53,7 +53,7 @@ class NumberHelperTest < ActionView::TestCase assert_equal("-$10.00", number_to_currency(-10)) end end - + def test_number_to_currency_without_currency_negative_format clean_i18n do I18n.backend.store_translations 'ts', :number => { :currency => { :format => { :unit => '@', :format => '%n %u' } } }