Attachment 688784 Details for Bug 903440 – For easier reading diff the diffs (to see what got changed)

For easier reading diff the diffs (to see what got changed)

upstream-3-0-json-parser-patches-diff.patch (text/plain), 7.02 KB, created by Jan Lieskovsky on 2013-01-28 08:33:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Lieskovsky

Created: 2013-01-28 08:33:32 UTC

Size: 7.02 KB

patch

obsolete

>--- old-3-0-json-parser.patch	2013-01-28 09:28:21.518865034 +0100
>+++ 3-0-json-parser.patch	2013-01-28 09:12:59.360000391 +0100
>@@ -1,16 +1,16 @@
>-From 58d373a110f5551a5511d1d11e2850fdabc8cf03 Mon Sep 17 00:00:00 2001
>+From 09c4ed43aa9b96de47c87bef4320694054a584c1 Mon Sep 17 00:00:00 2001
> From: Michael Koziarski <michael@koziarski.com>
> Date: Thu, 24 Jan 2013 08:57:12 +1300
>-Subject: [PATCH] Add an OkJson backend
>+Subject: [PATCH] Add an OkJson backend and remove the YAML backend
> 
>-Fixes CVE-2013-XXXX
>+Fixes CVE-2013-0333.  The ActiveSupport::JSON::Backends::Yaml class is present but the functionality has been removed entirely.
> ---
>  Gemfile                                            |    2 +-
>- .../lib/active_support/json/backends/okjson.rb     |  641 ++++++++++++++++++++
>- .../lib/active_support/json/backends/yaml.rb       |    1 +
>+ .../lib/active_support/json/backends/okjson.rb     |  644 ++++++++++++++++++++
>+ .../lib/active_support/json/backends/yaml.rb       |   94 +---
>  activesupport/lib/active_support/json/decoding.rb  |    2 +-
>  activesupport/test/json/decoding_test.rb           |    4 +-
>- 5 files changed, 646 insertions(+), 4 deletions(-)
>+ 5 files changed, 649 insertions(+), 97 deletions(-)
>  create mode 100644 activesupport/lib/active_support/json/backends/okjson.rb
> 
> diff --git a/Gemfile b/Gemfile
>@@ -28,10 +28,10 @@ index dc404e4..239cd77 100644
>    gem "rdoc",  "~> 3.4"
> diff --git a/activesupport/lib/active_support/json/backends/okjson.rb b/activesupport/lib/active_support/json/backends/okjson.rb
> new file mode 100644
>-index 0000000..378eb79
>+index 0000000..f720a87
> --- /dev/null
> +++ b/activesupport/lib/active_support/json/backends/okjson.rb
>-@@ -0,0 +1,641 @@
>+@@ -0,0 +1,644 @@
> +module ActiveSupport
> +  # Include OkJson as a replacement for the Yaml backend
> +  # encoding: UTF-8
>@@ -640,6 +640,9 @@ index 0000000..378eb79
> +
> +        # Parses a JSON string or IO and convert it into an object
> +        def decode(json)
>++          if json.respond_to?(:read)
>++            json = json.read
>++          end
> +          data = ActiveSupport::OkJson.decode(json)
> +          if ActiveSupport.parse_json_times
> +            convert_dates_from(data)
>@@ -673,19 +676,114 @@ index 0000000..378eb79
> +    end
> +  end
> +end
>-\ No newline at end of file
> diff --git a/activesupport/lib/active_support/json/backends/yaml.rb b/activesupport/lib/active_support/json/backends/yaml.rb
>-index 077eda5..3f28074 100644
>+index 077eda5..435d60a 100644
> --- a/activesupport/lib/active_support/json/backends/yaml.rb
> +++ b/activesupport/lib/active_support/json/backends/yaml.rb
>-@@ -19,6 +19,7 @@ module ActiveSupport
>-           if json.respond_to?(:read)
>-             json = json.read
>-           end
>-+          ActiveSupport::Deprecation.warn("Warning: The Yaml backend has been deprecated due to security risks, you should set ActiveSupport::JSON.backend = 'OkJson'")
>-           YAML.load(convert_json_to_yaml(json))
>-         rescue *EXCEPTIONS => e
>-           raise ParseError, "Invalid JSON string: '%s'" % json
>+@@ -8,102 +8,10 @@ module ActiveSupport
>+         extend self
>+ 
>+         EXCEPTIONS = [::ArgumentError] # :nodoc:
>+-        begin
>+-          require 'psych'
>+-          EXCEPTIONS << Psych::SyntaxError
>+-        rescue LoadError
>+-        end
>+ 
>+-        # Parses a JSON string or IO and converts it into an object
>+         def decode(json)
>+-          if json.respond_to?(:read)
>+-            json = json.read
>+-          end
>+-          YAML.load(convert_json_to_yaml(json))
>+-        rescue *EXCEPTIONS => e
>+-          raise ParseError, "Invalid JSON string: '%s'" % json
>++          raise "Warning: The Yaml backend has been deprecated due to security risks, you should set ActiveSupport::JSON.backend = 'OkJson'"
>+         end
>+-
>+-        protected
>+-          # Ensure that ":" and "," are always followed by a space
>+-          def convert_json_to_yaml(json) #:nodoc:
>+-            require 'strscan' unless defined? ::StringScanner
>+-            scanner, quoting, marks, pos, times = ::StringScanner.new(json), false, [], nil, []
>+-            while scanner.scan_until(/(\\['"]|['":,\\]|\\.)/)
>+-              case char = scanner[1]
>+-              when '"', "'"
>+-                if !quoting
>+-                  quoting = char
>+-                  pos = scanner.pos
>+-                elsif quoting == char
>+-                  if valid_date?(json[pos..scanner.pos-2])
>+-                    # found a date, track the exact positions of the quotes so we can
>+-                    # overwrite them with spaces later.
>+-                    times << pos
>+-                  end
>+-                  quoting = false
>+-                end
>+-              when ":",","
>+-                marks << scanner.pos - 1 unless quoting
>+-              when "\\"
>+-                scanner.skip(/\\/)
>+-              end
>+-            end
>+-
>+-            if marks.empty?
>+-              json.gsub(/\\([\\\/]|u[[:xdigit:]]{4})/) do
>+-                ustr = $1
>+-                if ustr.start_with?('u')
>+-                  char = [ustr[1..-1].to_i(16)].pack("U")
>+-                  # "\n" needs extra escaping due to yaml formatting
>+-                  char == "\n" ? "\\n" : char
>+-                elsif ustr == '\\'
>+-                  '\\\\'
>+-                else
>+-                  ustr
>+-                end
>+-              end
>+-            else
>+-              left_pos  = [-1].push(*marks)
>+-              right_pos = marks << scanner.pos + scanner.rest_size
>+-              output    = []
>+-              left_pos.each_with_index do |left, i|
>+-                scanner.pos = left.succ
>+-                chunk = scanner.peek(right_pos[i] - scanner.pos + 1)
>+-                # overwrite the quotes found around the dates with spaces
>+-                while times.size > 0 && times[0] <= right_pos[i]
>+-                  chunk.insert(times.shift - scanner.pos - 1, '! ')
>+-                end
>+-                chunk.gsub!(/\\([\\\/]|u[[:xdigit:]]{4})/) do
>+-                  ustr = $1
>+-                  if ustr.start_with?('u')
>+-                    char = [ustr[1..-1].to_i(16)].pack("U")
>+-                    # "\n" needs extra escaping due to yaml formatting
>+-                    char == "\n" ? "\\n" : char
>+-                  elsif ustr == '\\'
>+-                    '\\\\'
>+-                  else
>+-                    ustr
>+-                  end
>+-                end
>+-                output << chunk
>+-              end
>+-              output = output * " "
>+-
>+-              output.gsub!(/\\\//, '/')
>+-              output
>+-            end
>+-          end
>+-
>+-        private
>+-          def valid_date?(date_string)
>+-            begin
>+-              date_string =~ DATE_REGEX && DateTime.parse(date_string)
>+-            rescue ArgumentError
>+-              false
>+-            end
>+-          end
>+-
>+       end
>+     end
>+   end
> diff --git a/activesupport/lib/active_support/json/decoding.rb b/activesupport/lib/active_support/json/decoding.rb
> index c1f6330..7401ddf 100644
> --- a/activesupport/lib/active_support/json/decoding.rb
>@@ -717,3 +815,4 @@ index 24d9f88..7d352fb 100644
>  
> -- 
> 1.7.2
>+

Actions: View

Attachments on bug 903440: 686419 | 686420 | 688771 | 688784