From 43109ecb986470ef023a7e91beb9812718f000fe Mon Sep 17 00:00:00 2001
From: Jeremy Kemper <jeremy@bitsweat.net>
Date: Sat, 5 Jan 2013 17:46:26 -0700
Subject: CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or
 yaml.

---
 .../active_support/core_ext/hash/conversions.rb    | 32 +++++++++++++++++-----
 1 file changed, 25 insertions(+), 7 deletions(-)

(limited to 'activesupport/lib/active_support')

diff --git a/activesupport/lib/active_support/core_ext/hash/conversions.rb b/activesupport/lib/active_support/core_ext/hash/conversions.rb
index 5f07bb4f5a..b820a167a2 100644
--- a/activesupport/lib/active_support/core_ext/hash/conversions.rb
+++ b/activesupport/lib/active_support/core_ext/hash/conversions.rb
@@ -85,15 +85,33 @@ class Hash
     end
   end
 
+  class DisallowedType < StandardError #:nodoc:
+    def initialize(type)
+      super "Disallowed type attribute: #{type.inspect}"
+    end
+  end
+
+  DISALLOWED_XML_TYPES = %w(symbol yaml)
+
   class << self
-    def from_xml(xml)
-      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)))
+    def from_xml(xml, disallowed_types = nil)
+      typecast_xml_value(unrename_keys(ActiveSupport::XmlMini.parse(xml)), disallowed_types)
+    end
+
+    def from_trusted_xml(xml)
+      from_xml xml, []
     end
 
     private
-      def typecast_xml_value(value)
+      def typecast_xml_value(value, disallowed_types = nil)
+        disallowed_types ||= DISALLOWED_XML_TYPES
+
         case value.class.to_s
           when 'Hash'
+            if value.include?('type') && !value['type'].is_a?(Hash) && disallowed_types.include?(value['type'])
+              raise DisallowedType, value['type']
+            end
+
             if value['type'] == 'array'
               _, entries = Array.wrap(value.detect { |k,v| not v.is_a?(String) })
               if entries.nil? || (c = value['__content__'] && c.blank?)
@@ -101,9 +119,9 @@ class Hash
               else
                 case entries.class.to_s   # something weird with classes not matching here.  maybe singleton methods breaking is_a?
                 when "Array"
-                  entries.collect { |v| typecast_xml_value(v) }
+                  entries.collect { |v| typecast_xml_value(v, disallowed_types) }
                 when "Hash"
-                  [typecast_xml_value(entries)]
+                  [typecast_xml_value(entries, disallowed_types)]
                 else
                   raise "can't typecast #{entries.inspect}"
                 end
@@ -127,14 +145,14 @@ class Hash
             elsif value['type'] && value.size == 1 && !value['type'].is_a?(::Hash)
               nil
             else
-              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v)] }]
+              xml_value = Hash[value.map { |k,v| [k, typecast_xml_value(v, disallowed_types)] }]
 
               # Turn { :files => { :file => #<StringIO> } into { :files => #<StringIO> } so it is compatible with
               # how multipart uploaded files from HTML appear
               xml_value["file"].is_a?(StringIO) ? xml_value["file"] : xml_value
             end
           when 'Array'
-            value.map! { |i| typecast_xml_value(i) }
+            value.map! { |i| typecast_xml_value(i, disallowed_types) }
             value.length > 1 ? value : value.first
           when 'String'
             value
-- 
cgit v1.2.3


From 746dbd89faf8197e6d6f35f6e428a024923116a2 Mon Sep 17 00:00:00 2001
From: Aaron Patterson <aaron.patterson@gmail.com>
Date: Mon, 7 Jan 2013 16:15:56 -0800
Subject: bumping version

---
 activesupport/lib/active_support/version.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'activesupport/lib/active_support')

diff --git a/activesupport/lib/active_support/version.rb b/activesupport/lib/active_support/version.rb
index 94c22b0af6..e928403dd2 100644
--- a/activesupport/lib/active_support/version.rb
+++ b/activesupport/lib/active_support/version.rb
@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 10
+    TINY  = 11
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
-- 
cgit v1.2.3