From 17e6f1507b7f2c2a883c180f4f9548445d6dfbda Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Thu, 29 Oct 2015 10:42:44 -0700 Subject: use secure string comparisons for basic auth username / password this will avoid timing attacks against applications that use basic auth. CVE-2015-7576 --- activesupport/lib/active_support/security_utils.rb | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'activesupport') diff --git a/activesupport/lib/active_support/security_utils.rb b/activesupport/lib/active_support/security_utils.rb index 64c4801179..9be8613ada 100644 --- a/activesupport/lib/active_support/security_utils.rb +++ b/activesupport/lib/active_support/security_utils.rb @@ -1,3 +1,5 @@ +require 'digest' + module ActiveSupport module SecurityUtils # Constant time string comparison. @@ -16,5 +18,10 @@ module ActiveSupport res == 0 end module_function :secure_compare + + def variable_size_secure_compare(a, b) # :nodoc: + secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b)) + end + module_function :variable_size_secure_compare end end -- cgit v1.2.3 From 4642d68d8021893c69bfd16ed6e926ae03a6d777 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Mon, 18 Jan 2016 13:51:02 -0800 Subject: Eliminate instance level writers for class accessors Instance level writers can have an impact on how the Active Model / Record objects are saved. Specifically, they can be used to bypass validations. This is a problem if mass assignment protection is disabled and specific attributes are passed to the constructor. CVE-2016-0753 --- activesupport/lib/active_support/callbacks.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'activesupport') diff --git a/activesupport/lib/active_support/callbacks.rb b/activesupport/lib/active_support/callbacks.rb index bf560ec1fa..e6baddf5db 100644 --- a/activesupport/lib/active_support/callbacks.rb +++ b/activesupport/lib/active_support/callbacks.rb @@ -71,7 +71,7 @@ module ActiveSupport # halt the entire callback chain and display a deprecation message. # If false, callback chains will only be halted by calling +throw :abort+. # Defaults to +true+. - mattr_accessor(:halt_and_display_warning_on_return_false) { true } + mattr_accessor(:halt_and_display_warning_on_return_false, instance_writer: false) { true } # Runs the callbacks for the given event. # @@ -742,7 +742,7 @@ module ActiveSupport options = names.extract_options! names.each do |name| - class_attribute "_#{name}_callbacks" + class_attribute "_#{name}_callbacks", instance_writer: false set_callbacks name, CallbackChain.new(name, options) module_eval <<-RUBY, __FILE__, __LINE__ + 1 -- cgit v1.2.3 From 908c011395cc9e3ea1bb195f9d1bd30a9d9df98f Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Mon, 25 Jan 2016 10:22:15 -0800 Subject: bumping version --- activesupport/lib/active_support/gem_version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'activesupport') diff --git a/activesupport/lib/active_support/gem_version.rb b/activesupport/lib/active_support/gem_version.rb index 7790a9b2c0..3104d0e00f 100644 --- a/activesupport/lib/active_support/gem_version.rb +++ b/activesupport/lib/active_support/gem_version.rb @@ -8,7 +8,7 @@ module ActiveSupport MAJOR = 5 MINOR = 0 TINY = 0 - PRE = "beta1" + PRE = "beta1.1" STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".") end -- cgit v1.2.3