search

reabiliti / certification

CERTIFICATION
MIT License
0 stars 0 forks source link

🚨 [security] Update simple_form: 4.1.0 → 5.0.0 (major) #60

Closed depfu[bot] closed 4 years ago

depfu[bot] commented 5 years ago

🚨 Your version of simple_form has known security vulnerabilities 🚨

Advisory: CVE-2019-16676 Disclosed: September 27, 2019 URL: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx

simple_form Gem for Ruby Incorrect Access Control for forms based on user input

Simple Form before 5.0 has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb,
because a user-supplied string is invoked as a method call.

This only happens for pages that build forms based on user input.


🚨 We recommend to merge and deploy this update as soon as possible! 🚨

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ simple_form (4.1.0 → 5.0.0) · Repo · Changelog

Release Notes

5.0.0 (from changelog)

Enhancements

  • Set multiple attribute for grouped selects also. @ollym
  • Removes or renames label classes. Abduvakilov
  • Support to label custom classes for inline collections. @feliperenan
  • Update bootstrap generator template to match v4.3.x. @m5o
  • Allow "required" attribute in generated select elements of PriorityInput. @mcountis

Bug fix

  • Do not call #send in form object to check whether the attribute is a file input. @tegon

Deprecations

  • The config SimpleForm.file_methods is deprecated and it has no effect. Simple Form now supports automatically discover of file inputs for the following Gems: activestorage, carrierwave, paperclip, refile and shrine. If you are using a custom method that is not from one of the supported Gems, please change your forms to pass the input type explicitly:
 <%= form.input :avatar, as: :file %>

See http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676 for more information.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 42 commits:

↗️ erubi (indirect, 1.8.0 → 1.9.0) · Repo · Changelog

Release Notes

1.9.0 (from changelog)

* Change default :bufvar from 'String.new' to '::String.new' to work with BasicObject (jeremyevans)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ loofah (indirect, 2.2.3 → 2.3.0) · Repo · Changelog

Release Notes

2.3.0 (from changelog)

Features

  • Expand set of allowed protocols to include tel: and line:. [#104, #147]
  • Expand set of allowed CSS functions. [related to #122]
  • Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!)
  • Allow CSS property list-style [#162] (Thanks, @jaredbeck!)
  • Allow CSS keywords thick and thin [#168] (Thanks, @georgeclaghorn!)
  • Allow HTML property contenteditable [#167] (Thanks, @andreynering!)

Bug fixes

  • CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!)

Deprecations / Name Changes

The following method and constants are hereby deprecated, and will be completely removed in a future release:

  • Deprecate Loofah::Helpers::ActionView.white_list_sanitizer, please use Loofah::Helpers::ActionView.safe_list_sanitizer instead.
  • Deprecate Loofah::Helpers::ActionView::WhiteListSanitizer, please use Loofah::Helpers::ActionView::SafeListSanitizer instead.
  • Deprecate Loofah::HTML5::WhiteList, please use Loofah::HTML5::SafeList instead.

Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.

Does any of this look wrong? Please let us know.

↗️ minitest (indirect, 5.11.3 → 5.12.2) · Repo · Changelog

Release Notes

5.12.2 (from changelog)

  • 1 bug fix:

    • After chatting w/ @y-yagi and others, decided to lower support to include ruby 2.2.

5.12.1 (from changelog)

  • 1 minor enhancement:

    • Added documentation for Reporter classes. (sshaw)

  • 3 bug fixes:

    • Avoid using 'match?' to support older ruby versions. (y-yagi)

    • Fixed broken link to reference on goodness-of-fit testing. (havenwood)

    • Update requirements in readme and Rakefile/hoe spec.

5.12.0 (from changelog)

  • 8 minor enhancements:

    • Added a descriptive error if assert_output or assert_raises called without a block. (okuramasafumi)

    • Changed mu_pp_for_diff to make having both n and \n easier to debug.

    • Deprecated $N for specifying number of parallel test runners. Use MT_CPU.

    • Deprecated use of global expectations. To be removed from MT6.

    • Extended Assertions#mu_pp to encoding validity output for strings to improve diffs.

    • Extended Assertions#mu_pp to output encoding and validity if invalid to improve diffs.

    • Extended Assertions#mu_pp_for_diff to make escaped newlines more obvious in diffs.

    • Fail gracefully when expectation used outside of `it`.

  • 3 bug fixes:

    • Check `option` klass before match. Fixes 2.6 warning. (y-yagi)

    • Fixed Assertions#diff from recalculating if set to nil

    • Fixed spec section of readme to not use deprecated global expectations. (CheezItMan)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ nokogiri (indirect, 1.10.1 → 1.10.4) · Repo · Changelog

Release Notes

1.10.4

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is #1915

1.10.3

1.10.3 / 2019-04-22

Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in #1892. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

1.10.2

1.10.2 / 2019-03-24

Security

  • [MRI] Remove support from vendored libxml2 for future script macros. [#1871]
  • [MRI] Remove support from vendored libxml2 for server-side includes within attributes. [#1877]

Bug fixes

  • [JRuby] Fix node ownership in duplicated documents. [#1060]
  • [JRuby] Rethrow exceptions caught by Java SAX handler. [#1847, #1872] (Thanks, @adjam!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rack (indirect, 2.0.6 → 2.0.7) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ rails-html-sanitizer (indirect, 1.0.4 → 1.2.0) · Repo · Changelog

Release Notes

1.2.0

  • Remove needless white_list_sanitizer deprecation.

    By deprecating this, we were forcing Rails 5.2 to be updated or spew
    deprecations that users could do nothing about.

    That's pointless and I'm sorry for adding that!

    Now there's no deprecation warning and Rails 5.2 works out of the box, while
    Rails 6 can use the updated naming.

    Kasper Timm Hansen

1.1.0

  • Add safe_list_sanitizer and deprecate white_list_sanitizer to be removed
    in 1.2.0. #87

    Juanito Fatas

  • Remove href from LinkScrubber's tags as it's not an element.
    #92

    Juanito Fatas

  • Explain that we don't need to bump Loofah here if there's CVEs.
    d4d823c

    Kasper Timm Hansen

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Travis-CI](https://travis-ci.com) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)