You are viewing an historical archive of past issues. Please report new issues to the appropriate project issue tracker on GitHub.

Feature request #1824: Update to Rails 3.0.9, and Rails 3.1.0.rc4

Kind feature request
Product wincent.dev
When Created , updated
Status closed
Reporter Greg Hurrell
Tags no tags

Description

Unless 3.1.0 goes final first...

Comments

  1. Greg Hurrell

    Status changed:

    • From: new
    • To: open
  2. Greg Hurrell

    rc3 is a lemon, so wait for rc4 instead:

  3. Greg Hurrell

    Summary changed:

    • From: Trial Rails 3.0.8.rc3
    • To: Trial Rails 3.0.8.rc4
  4. Greg Hurrell

    Summary changed:

    • From: Trial Rails 3.0.8.rc4
    • To: Update to Rails 3.0.8, and Rails 3.1.0.rc2
  5. Greg Hurrell

    3.0.8 final is now out, with a security fix. 3.1.0.rc2 is also out, containing the same fix. 

    # Potential XSS Vulnerability in Ruby on Rails Applications

The XSS prevention support in recent versions Ruby on Rails allows some string operations which, when combined with user supplied data, may leave an 'unsafe string' incorrectly considered safe.  It is unlikely that applications call these methods, however we are shipping new versions today which prevent their use to ensure they're not called unintentionally.

## How the XSS Prevention Works

When strings are rendered to the client, if the string is not marked as "html safe", the string will be automatically escaped and marked as "html safe". Some helper methods automatically return strings already marked as safe.

For example:

   <%= link_to('hello world', @user) %>

The `link_to` method will return a string marked as html safe.  Since `link_to` returns an "html safe" string (also known as a safe buffer), the text will be output directly, meaning the user sees a link tag rather than escaped HTML.

## The Problem

Safe buffers are allowed to be mutated in place via methods like `sub!`.  These methods can add unsafe strings to a safe buffer, and the safe buffer will continue to be marked safe.

An example problem would be something like this:

   <%= link_to('hello world', @user).sub!(/hello/, params[:xss])  %>

In the above example, an untrusted string (`params[:xss]`) is added to the safe buffer returned by `link_to`, and the untrusted content is successfully sent to the client without being escaped.  To prevent this from happening `sub!` and other similar methods will now raise an exception when they are called on a safe buffer.

In addition to the in-place versions, some of the versions of these methods which return a copy of the string will incorrectly mark strings as safe.  For example:

   <%= link_to('hello world', @user).sub(/hello/, params[:xss]) %>

The new versions will now ensure that *all* strings returned by these methods on safe buffers are marked unsafe.
## Affected versions

This problem affects all versions of rails: 3.1.0.rc1, 3.0.7, and 2.3.11.

## The Solution

Any methods that mutate the safe buffer without escaping input will now raise
an exception.

If you need to modify a safe buffer, cast it to a Ruby string first by calling
the `to_str` method:

   <%= link_to('hello world', @user).to_str.sub!(/hello/, params[:xss]) %>

## Upgrading

This problem is fixed in Rails 3.1.0.rc2, 3.0.8, and 2.3.12 (with rails_xss) (which will be
released in the next hour).  If for some reason you cannot upgrade your Rails
installation, please apply these patches (also find them attached):


 * [For 3.1.0.rc1](https://gist.github.com/89d6266cc7875614c5a5) 
 * [For 3.0.7](https://gist.github.com/b2ceb626fc2bcdfe497f)
 * [For 2.3.11, specifically the rails_xss plugin](https://gist.github.com/392235903426322e0414) 

## Thanks

Thanks to Bruno Michel of LinuxFr.org and Brett Valantine who each independently reported the issue to us.
  6. Greg Hurrell

    Summary changed:

    • From: Update to Rails 3.0.8, and Rails 3.1.0.rc2
    • To: Update to Rails 3.0.8, and Rails 3.1.0.rc3
  7. Greg Hurrell

    Summary changed:

    • From: Update to Rails 3.0.8, and Rails 3.1.0.rc3
    • To: Update to Rails 3.0.9.rc1, and Rails 3.1.0.rc3
  8. Greg Hurrell
  9. Greg Hurrell

    Tried 'em out, but time to try out some more:

  10. Greg Hurrell

    Summary changed:

    • From: Update to Rails 3.0.9.rc1, and Rails 3.1.0.rc3
    • To: Update to Rails 3.0.9.rc3, and Rails 3.1.0.rc4
  11. Greg Hurrell

    Summary changed:

    • From: Update to Rails 3.0.9.rc3, and Rails 3.1.0.rc4
    • To: Update to Rails 3.0.9.rc5, and Rails 3.1.0.rc4
  12. Greg Hurrell

    Summary changed:

    • From: Update to Rails 3.0.9.rc5, and Rails 3.1.0.rc4
    • To: Update to Rails 3.0.9, and Rails 3.1.0.rc4
  13. Greg Hurrell

    http://weblog.rubyonrails.org/2011/6/16/ann-rails-3-0-9-has-been-released

  14. Greg Hurrell

    Superseded by ticket #1861.

  15. Greg Hurrell

    Status changed:

    • From: open
    • To: closed
Add a comment

Comments are now closed for this issue.

Menu