Fix rescuing of application errors when call_app! is used.
As a consequence of the changes that were merged in #689, errors
thrown by strategies that utilize other_phase (or more specifically
call_app!), would be caught by omniauth, causing headaches for folks
looking to have those errors handled by their application. This
should allow for errors that come from the app to pass through, while
passing errors that come from the authentication phases to the fail!
handler.
Fix for incorrect order of request_validation_phase in test_mode.
@jsdalton gave an awesome report of the issue present in test_mode in #1033
The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.
This creates two problems:
When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.
Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.
Allow passing rack-protection configuration to default request_validation_phase
This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.
Fix and add protections for XSS in ActionView::Helpers and ERB::Util.
Add the method ERB::Util.xml_name_escape to escape dangerous characters
in names of tags and names of attributes, following the specification of XML.
Álvaro Martín Fraguas
Active Model
No changes.
Active Record
No changes.
Action View
Fix and add protections for XSS in ActionView::Helpers and ERB::Util.
Escape dangerous characters in names of tags and names of attributes in the
tag helpers, following the XML specification. Rename the option
:escape_attributes to :escape, to simplify by applying the option to the
whole tag.
Álvaro Martín Fraguas
Action Pack
Allow Content Security Policy DSL to generate for API responses.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/espen/balder/network/alerts).
Bumps omniauth and rails. These dependencies needed to be updated together. Updates
omniauth
from 1.4.2 to 2.1.0Release notes
Sourced from omniauth's releases.
... (truncated)
Commits
9cd7aad
relax racke84a6e6
Release 2.1.0da210c7
Merge pull request #1062 from barttenbrinke/feature/add_rails_section_to_readme62f96bd
Merge pull request #1064 from omniauth/support-for-ruby-3_0928e7e5
Support for ruby 3.0+2f4d4a3
Update README.md898be28
Update README.md63d1139
Merge pull request #1050 from ybiquitous/add-ruby-3.0-to-cif7192a8
Add 3.186c01db
Add Ruby 3.0 to CIUpdates
rails
from 3.2.22.5 to 6.1.6.1Release notes
Sourced from rails's releases.
... (truncated)
Commits
dc1242f
Preparing for 6.1.6.1 release0bce40f
updating version and changelog8ce4bd1
Change ActiveRecord::Coders::YAMLColumn default to safe_load147557d
Preparing for 6.1.6 release7c2da9e
Merge pull request #45027 from rails/fix-tag-helper-regression3bcb481
Merge branch '6-1-sec' into 6-1-stablee2efc66
Preparing for 6.1.5.1 release57e8d5e
updating changelog for release123f42a
Fix and add protections for XSS in names.2b820a2
Merge pull request #44635 from imtayadeway/tjw/api-csp-iDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/espen/balder/network/alerts).