Attachment 696260 Details for Bug 909528 – 2-3-attr_protected-cve-2013-0276.patch

[patch] 2-3-attr_protected-cve-2013-0276.patch

2-3-attr_protected-cve-2013-0276.patch (text/plain), 2.67 KB, created by Kurt Seifried on 2013-02-11 19:55:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-02-11 19:55:43 UTC

Size: 2.67 KB

patch

obsolete

>From 9a48f4cf329f66682c34c86822d625d63dbb6919 Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Sat, 9 Feb 2013 16:31:04 -0800
>Subject: [PATCH] fixing attr_protected CVE-2013-0276
>
>---
> activerecord/lib/active_record/attribute_methods.rb | 2 +-
> activerecord/lib/active_record/base.rb              | 6 +++---
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
>diff --git a/activerecord/lib/active_record/attribute_methods.rb b/activerecord/lib/active_record/attribute_methods.rb
>index 22630b3..5f0ca58 100644
>--- a/activerecord/lib/active_record/attribute_methods.rb
>+++ b/activerecord/lib/active_record/attribute_methods.rb
>@@ -130,7 +130,7 @@ module ActiveRecord
>         # Suffixes a, ?, c become regexp /(a|\?|c)$/
>         def rebuild_attribute_method_regexp
>           suffixes = attribute_method_suffixes.map { |s| Regexp.escape(s) }
>-          @@attribute_method_regexp = /(#{suffixes.join('|')})$/.freeze
>+          @@attribute_method_regexp = /(#{suffixes.join('|')})\z/.freeze
>         end
> 
>         # Default to =, ?, _before_type_cast
>diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb
>index cfc6e86..c11b702 100755
>--- a/activerecord/lib/active_record/base.rb
>+++ b/activerecord/lib/active_record/base.rb
>@@ -2998,11 +2998,11 @@ module ActiveRecord #:nodoc:
>       def remove_attributes_protected_from_mass_assignment(attributes)
>         safe_attributes =
>           if self.class.accessible_attributes.nil? && self.class.protected_attributes.nil?
>-            attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
>+            attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
>           elsif self.class.protected_attributes.nil?
>-            attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
>+            attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/m, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
>           elsif self.class.accessible_attributes.nil?
>-            attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
>+            attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/m,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
>           else
>             raise "Declare either attr_protected or attr_accessible for #{self.class}, but not both."
>           end
>-- 
>1.8.1.1
>

Actions: View | Diff

Attachments on bug 909528: 696260 | 696261 | 696262 | 696263