Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: rails/rails
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v5.2.4.1
Choose a base ref
...
head repository: rails/rails
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.2.4.3
Choose a head ref
  • 12 commits
  • 44 files changed
  • 5 contributors

Commits on Mar 19, 2020

  1. Fix possible XSS vector in JS escape helper 

    This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper

CVE-2020-5267
    @tenderlove
    tenderlove committed Mar 19, 2020
    Configuration menu
    Copy the full SHA
    b5aeef5 View commit details
    Browse the repository at this point in the history

  2. update version

    @tenderlove
    tenderlove committed Mar 19, 2020
    Configuration menu
    Copy the full SHA
    4dcc543 View commit details
    Browse the repository at this point in the history

Commits on May 14, 2020

  1. Include Content-Length in signature for ActiveStorage direct upload 

    [CVE-2020-8162]
    @travisp @tenderlove
    travisp authored and tenderlove committed May 14, 2020
    Configuration menu
    Copy the full SHA
    e8df564 View commit details
    Browse the repository at this point in the history

Commits on May 15, 2020

  1. Return self when calling #each, #each_pair, and #each_value instead o… 

    …f the raw @parameters hash

[CVE-2020-8164]
    @JackMc @tenderlove
    JackMc authored and tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    7a3ee4f View commit details
    Browse the repository at this point in the history

  2. activesupport: Avoid Marshal.load on raw cache value in MemCacheStore 

    Dalli is already being used for marshalling, so we should also rely
on it for unmarshalling. Since Dalli tags the cache value as marshalled
it can avoid unmarshalling a raw string which might have come from
an untrusted source.

[CVE-2020-8165]
    @dylanahsmith @tenderlove
    dylanahsmith authored and tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    f7e077f View commit details
    Browse the repository at this point in the history

  3. activesupport: Deprecate Marshal.load on raw cache read in RedisCache… 

    …Store

The same value for the `raw` option should be provided for both reading and
writing to avoid Marshal.load being called on untrusted data.

[CVE-2020-8165]
    @dylanahsmith @tenderlove
    dylanahsmith authored and tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    467e339 View commit details
    Browse the repository at this point in the history

  4. HMAC raw CSRF token before masking it, so it cannot be used to recons… 

    …truct a per-form token

[CVE-2020-8166]
    @JackMc @tenderlove
    JackMc authored and tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    d124f19 View commit details
    Browse the repository at this point in the history

  5. Check that request is same-origin prior to including CSRF token in XHRs 

    [CVE-2020-8167]
    @JackMc @tenderlove
    JackMc authored and tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    fbc7bec View commit details
    Browse the repository at this point in the history

  6. update changelog

    @tenderlove
    tenderlove committed May 15, 2020
    Configuration menu
    Copy the full SHA
    9cb66f6 View commit details
    Browse the repository at this point in the history

Commits on May 18, 2020

  1. bumping version

    @tenderlove
    tenderlove committed May 18, 2020
    Configuration menu
    Copy the full SHA
    3c806b9 View commit details
    Browse the repository at this point in the history

  2. updating changelog

    @tenderlove
    tenderlove committed May 18, 2020
    Configuration menu
    Copy the full SHA
    559cce2 View commit details
    Browse the repository at this point in the history

  3. Preparing for 5.2.4.3 release

    @tenderlove
    tenderlove committed May 18, 2020
    Configuration menu
    Copy the full SHA
    7b5cc5a View commit details
    Browse the repository at this point in the history
Loading