🚨 [security] Update all of rails: 5.2.4.2 → 5.2.4.3 (patch)

[depfu]

---

🚨 Your version of actionpack has known security vulnerabilities 🚨

Advisory: CVE-2020-8164
Disclosed: May 18, 2020
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack.

Versions Affected: rails <= 6.0.3
Not affected: rails < 4.0.0
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of each, or each_value,
or each_pair will return the underlying "untrusted" hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end
def clean_up_params

params.each { |k, v|  SomeModel.check(v) if k == :name }

end

Note the mistaken use of each in the clean_up_params method in the above
example.

Workarounds

Do not use the return values of each, each_value, or each_pair in your
application.

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (5.2.4.2 → 5.2.4.3) · Repo

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ actioncable (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ actionmailer (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ actionpack (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ actionview (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ activejob (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ activemodel (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ activerecord (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ activestorage (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

↗️ activesupport (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ loofah (indirect, 2.4.0 → 2.5.0) · Repo · Changelog

Release Notes

2.5.0 (from changelog)

Features

• Allow more CSS length units: "ch", "vw", "vh", "Q", "lh", "vmin", "vmax". [#178] (Thanks, @JuanitoFatas!)

Fixes

• Remove comments from Loofah::HTML::Documents that exist outside the html element. [#80]

Other changes

• Gem metadata being set [#181] (Thanks, @JuanitoFatas!)
• Test files removed from gem file [#180,#166,#159] (Thanks, @JuanitoFatas and @greysteil!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

• version bump to v2.5.0
• ci: update concourse pipelines with latest rubies
• bug: remove HTML comments that exist outside the `html` element
• update CHANGELOG
• Merge pull request #180 from JuanitoFatas/remove-tests-from-gem
• Merge pull request #178 from JuanitoFatas/allow-more-css-values
• Merge pull request #181 from JuanitoFatas/fix-metadata
• Update URL to hash format to generate metadata
• Revert changes to generated gemspec
• Remove test files from final gem
• CSS sanitizer allows vmax length unit
• CSS sanitizer allows vmin length unit
• CSS sanitizer allows lh length unit
• CSS sanitizer allows Q length unit
• CSS sanitizer allows vh length unit
• CSS sanitizer allows vw length unit
• CSS sanitizer allows "ch" length unit
• Merge pull request #170 from orien/gem-metadata
• run `rufo` on test files
• run `rufo` on all lib files
• bump dev gemspec

↗️ mimemagic (indirect, 0.3.4 → 0.3.5) · Repo · Changelog

Release Notes

0.3.5 (from changelog)

Mimetype extensions are now ordered by freedesktop.org's priority

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 2 commits:

• v0.3.5
• Mimetype extensions are now ordered by freedesktop.org's priority

↗️ minitest (indirect, 5.14.0 → 5.14.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 6 commits:

• prepped for release
• + Minitest.filter_backtrace returns original backtrace if filter comes back empty.
• Refactored positive spec tests w/ a custom assertion.
• + Return true on a successful refute. (jusleg)
• Updated rake specs for latest assertions.
• - Fixed expectation doco to not use global expectations.

↗️ railties (indirect, 5.2.4.2 → 5.2.4.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

↗️ tzinfo (indirect, 1.2.6 → 1.2.7) · Repo · Changelog

Release Notes

1.2.7

• Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
• Fixed warnings when running on Ruby 2.8. #112.

TZInfo v1.2.7 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

• Improve grammar.
• Preparing v1.2.7.
• Update to Ruby 2.7.1.
• Revert to Ruby 2.4.9 and 2.7.0.
• Update to Ruby 2.4.10, 2.5.8, 2.6.6, 2.7.1 and JRuby 9.2.11.1.
• Use shields.io for badges.
• Update copyright years.
• Add a build status badge for AppVeyor.
• Replace broken links.
• Use https for links where available.
• Update to JRuby 9.2.11.0.
• Merge pull request #112.
• Test for just the non-existence of #untaint.
• Fix comments relating to taint/untaint removal.
• Don't rely on lexicographic version comparisons.
• Fix test failures on Ruby 1.8.7.
• Fix erroneous 'wrong number of arguments' errors on JRuby 9.0.5.0.
• `$VERBOSE = false` won't be worked since `rb_warning` is changed to `rb_warn`
• Update to Ruby 2.7.0.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #193.

[depfu]

Closed in favor of #207.