diff options
author | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 18:15:59 -0300 |
---|---|---|
committer | Santiago Pastorino <santiago@wyeworks.com> | 2012-08-09 18:15:59 -0300 |
commit | 7987e7419a75b5677841c4f215791a73083a154a (patch) | |
tree | 7164002ad5b52dd5a52114cfd9a4a2f7c5fc7049 | |
parent | 0f9a6a7c80a2beeaace875d8a9d89a164811d729 (diff) | |
parent | 64146cf7babe35fd962576b699fa0deb4cfe0d70 (diff) | |
download | rails-7987e7419a75b5677841c4f215791a73083a154a.tar.gz rails-7987e7419a75b5677841c4f215791a73083a154a.tar.bz2 rails-7987e7419a75b5677841c4f215791a73083a154a.zip |
Merge branch '3-2-8' into 3-2-stable
-rw-r--r-- | RAILS_VERSION | 2 | ||||
-rw-r--r-- | actionmailer/CHANGELOG.md | 2 | ||||
-rw-r--r-- | actionmailer/lib/action_mailer/version.rb | 2 | ||||
-rw-r--r-- | actionpack/CHANGELOG.md | 16 | ||||
-rw-r--r-- | actionpack/lib/action_pack/version.rb | 2 | ||||
-rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 4 | ||||
-rw-r--r-- | actionpack/lib/action_view/helpers/sanitize_helper.rb | 2 | ||||
-rw-r--r-- | actionpack/test/template/form_tag_helper_test.rb | 6 | ||||
-rw-r--r-- | actionpack/test/template/sanitize_helper_test.rb | 4 | ||||
-rw-r--r-- | activemodel/CHANGELOG.md | 2 | ||||
-rw-r--r-- | activemodel/lib/active_model/version.rb | 2 | ||||
-rw-r--r-- | activerecord/CHANGELOG.md | 8 | ||||
-rw-r--r-- | activerecord/lib/active_record/version.rb | 2 | ||||
-rw-r--r-- | activeresource/CHANGELOG.md | 2 | ||||
-rw-r--r-- | activeresource/lib/active_resource/version.rb | 2 | ||||
-rw-r--r-- | activesupport/CHANGELOG.md | 4 | ||||
-rw-r--r-- | activesupport/lib/active_support/version.rb | 2 | ||||
-rw-r--r-- | railties/CHANGELOG.md | 2 | ||||
-rw-r--r-- | railties/lib/rails/version.rb | 2 | ||||
-rw-r--r-- | version.rb | 2 |
20 files changed, 49 insertions, 21 deletions
diff --git a/RAILS_VERSION b/RAILS_VERSION index eb50c35660..f092941a75 100644 --- a/RAILS_VERSION +++ b/RAILS_VERSION @@ -1 +1 @@ -3.2.8.rc1 +3.2.8 diff --git a/actionmailer/CHANGELOG.md b/actionmailer/CHANGELOG.md index 06ee659c25..4594a1a7b1 100644 --- a/actionmailer/CHANGELOG.md +++ b/actionmailer/CHANGELOG.md @@ -1,4 +1,4 @@ -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## * No changes. diff --git a/actionmailer/lib/action_mailer/version.rb b/actionmailer/lib/action_mailer/version.rb index ed1d28eca9..bd1d3666d2 100644 --- a/actionmailer/lib/action_mailer/version.rb +++ b/actionmailer/lib/action_mailer/version.rb @@ -3,7 +3,7 @@ module ActionMailer MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index 6a55fc2b9f..9d413c8fb3 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -3,7 +3,21 @@ * `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist* -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## + +* There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the + helper doesn't correctly handle malformed html. As a result an attacker can + execute arbitrary javascript through the use of specially crafted malformed + html. + + *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino* + +* When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped. + If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks. + Vulnerable code will look something like this: + select_tag("name", options, :prompt => UNTRUSTED_INPUT) + + *Santiago Pastorino* * Reverted the deprecation of `:confirm`. *Rafael Mendonça França* diff --git a/actionpack/lib/action_pack/version.rb b/actionpack/lib/action_pack/version.rb index 2450285975..7296b19cf7 100644 --- a/actionpack/lib/action_pack/version.rb +++ b/actionpack/lib/action_pack/version.rb @@ -3,7 +3,7 @@ module ActionPack MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 066b98d4a2..9e0ec17836 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -122,11 +122,11 @@ module ActionView html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name if options.delete(:include_blank) - option_tags = "<option value=\"\"></option>".html_safe + option_tags + option_tags = content_tag(:option, '', :value => '').safe_concat(option_tags) end if prompt = options.delete(:prompt) - option_tags = "<option value=\"\">#{prompt}</option>".html_safe + option_tags + option_tags = content_tag(:option, prompt, :value => '').safe_concat(option_tags) end content_tag :select, option_tags, { "name" => html_name, "id" => sanitize_to_id(name) }.update(options.stringify_keys) diff --git a/actionpack/lib/action_view/helpers/sanitize_helper.rb b/actionpack/lib/action_view/helpers/sanitize_helper.rb index 7768c8c151..0f6a5ed405 100644 --- a/actionpack/lib/action_view/helpers/sanitize_helper.rb +++ b/actionpack/lib/action_view/helpers/sanitize_helper.rb @@ -80,7 +80,7 @@ module ActionView # strip_tags("<div id='top-bar'>Welcome to my website!</div>") # # => Welcome to my website! def strip_tags(html) - self.class.full_sanitizer.sanitize(html).try(:html_safe) + self.class.full_sanitizer.sanitize(html) end # Strips all link tags from +text+ leaving just the link text. diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb index 68dfceef07..6f0d0c3561 100644 --- a/actionpack/test/template/form_tag_helper_test.rb +++ b/actionpack/test/template/form_tag_helper_test.rb @@ -208,6 +208,12 @@ class FormTagHelperTest < ActionView::TestCase assert_dom_equal expected, actual end + def test_select_tag_escapes_prompt + actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "<script>alert(1337)</script>" + expected = %(<select id="places" name="places"><option value=""><script>alert(1337)</script></option><option>Home</option><option>Work</option><option>Pub</option></select>) + assert_dom_equal expected, actual + end + def test_select_tag_with_prompt_and_include_blank actual = select_tag "places", "<option>Home</option><option>Work</option><option>Pub</option>".html_safe, :prompt => "string", :include_blank => true expected = %(<select name="places" id="places"><option value="">string</option><option value=""></option><option>Home</option><option>Work</option><option>Pub</option></select>) diff --git a/actionpack/test/template/sanitize_helper_test.rb b/actionpack/test/template/sanitize_helper_test.rb index 222d4dbf4c..cc93b53ea6 100644 --- a/actionpack/test/template/sanitize_helper_test.rb +++ b/actionpack/test/template/sanitize_helper_test.rb @@ -42,9 +42,9 @@ class SanitizeHelperTest < ActionView::TestCase [nil, '', ' '].each do |blank| stripped = strip_tags(blank) assert_equal blank, stripped - assert stripped.html_safe? unless blank.nil? end - assert strip_tags("<script>").html_safe? + assert_equal "", strip_tags("<script>") + assert_equal "something <img onerror=alert(1337)", ERB::Util.html_escape(strip_tags("something <img onerror=alert(1337)")) end def test_sanitize_is_marked_safe diff --git a/activemodel/CHANGELOG.md b/activemodel/CHANGELOG.md index 3cab13a709..ead38c650c 100644 --- a/activemodel/CHANGELOG.md +++ b/activemodel/CHANGELOG.md @@ -1,4 +1,4 @@ -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## * No changes. diff --git a/activemodel/lib/active_model/version.rb b/activemodel/lib/active_model/version.rb index a0bc099ced..39ef5d289f 100644 --- a/activemodel/lib/active_model/version.rb +++ b/activemodel/lib/active_model/version.rb @@ -3,7 +3,7 @@ module ActiveModel MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md index 01f41184cd..69387cd77c 100644 --- a/activerecord/CHANGELOG.md +++ b/activerecord/CHANGELOG.md @@ -16,7 +16,13 @@ *Seamus Abshere* -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## + +* Do not consider the numeric attribute as changed if the old value is zero and the new value + is not a string. + Fixes #7237. + + *Rafael Mendonça França* * Do not consider the numeric attribute as changed if the old value is zero and the new value is not a string. diff --git a/activerecord/lib/active_record/version.rb b/activerecord/lib/active_record/version.rb index 9dea5ae187..0f91199469 100644 --- a/activerecord/lib/active_record/version.rb +++ b/activerecord/lib/active_record/version.rb @@ -3,7 +3,7 @@ module ActiveRecord MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/activeresource/CHANGELOG.md b/activeresource/CHANGELOG.md index ee92fc38a4..c47559d089 100644 --- a/activeresource/CHANGELOG.md +++ b/activeresource/CHANGELOG.md @@ -1,4 +1,4 @@ -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## * No changes. diff --git a/activeresource/lib/active_resource/version.rb b/activeresource/lib/active_resource/version.rb index eefc379cc6..10edd60305 100644 --- a/activeresource/lib/active_resource/version.rb +++ b/activeresource/lib/active_resource/version.rb @@ -3,7 +3,7 @@ module ActiveResource MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md index 045ac4cde6..8e7b780dd6 100644 --- a/activesupport/CHANGELOG.md +++ b/activesupport/CHANGELOG.md @@ -1,4 +1,6 @@ -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## + +* Fix ActiveSupport integration with Mocha > 0.12.1. *Mike Gunderloy* * Reverted the deprecation of ActiveSupport::JSON::Variable. *Rafael Mendonça França* diff --git a/activesupport/lib/active_support/version.rb b/activesupport/lib/active_support/version.rb index bc3f3a9d07..03074bebc6 100644 --- a/activesupport/lib/active_support/version.rb +++ b/activesupport/lib/active_support/version.rb @@ -3,7 +3,7 @@ module ActiveSupport MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md index 2537993df3..52494d5232 100644 --- a/railties/CHANGELOG.md +++ b/railties/CHANGELOG.md @@ -1,4 +1,4 @@ -## Rails 3.2.8 ## +## Rails 3.2.8 (Aug 9, 2012) ## * ERB scaffold generator use the `:data => { :confirm => "Text" }` syntax instead of `:confirm`. diff --git a/railties/lib/rails/version.rb b/railties/lib/rails/version.rb index e429caa157..4565e13fc7 100644 --- a/railties/lib/rails/version.rb +++ b/railties/lib/rails/version.rb @@ -3,7 +3,7 @@ module Rails MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end diff --git a/version.rb b/version.rb index e429caa157..4565e13fc7 100644 --- a/version.rb +++ b/version.rb @@ -3,7 +3,7 @@ module Rails MAJOR = 3 MINOR = 2 TINY = 8 - PRE = "rc1" + PRE = nil STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.') end |