Attachment 696263 Details for Bug 909528 – 3-2-attr_protected-cve-2013-0276.patch

[patch] 3-2-attr_protected-cve-2013-0276.patch

3-2-attr_protected-cve-2013-0276.patch (text/plain), 1.71 KB, created by Kurt Seifried on 2013-02-11 19:56:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-02-11 19:56:30 UTC

Size: 1.71 KB

patch

obsolete

>From 060bb7250b963609a0d8a5d0559e36b99d2402c6 Mon Sep 17 00:00:00 2001
>From: joernchen of Phenoelit <joernchen@phenoelit.de>
>Date: Sat, 9 Feb 2013 15:46:44 -0800
>Subject: [PATCH] Fix issue with attr_protected where malformed input could
> circumvent protection
>
>Fixes: CVE-2013-0276
>---
> activemodel/lib/active_model/attribute_methods.rb                       | 2 +-
> activemodel/lib/active_model/mass_assignment_security/permission_set.rb | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/activemodel/lib/active_model/attribute_methods.rb b/activemodel/lib/active_model/attribute_methods.rb
>index f033a94..96f2c82 100644
>--- a/activemodel/lib/active_model/attribute_methods.rb
>+++ b/activemodel/lib/active_model/attribute_methods.rb
>@@ -365,7 +365,7 @@ module ActiveModel
>             end
> 
>             @prefix, @suffix = options[:prefix] || '', options[:suffix] || ''
>-            @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/
>+            @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/
>             @method_missing_target = "#{@prefix}attribute#{@suffix}"
>             @method_name = "#{prefix}%s#{suffix}"
>           end
>diff --git a/activemodel/lib/active_model/mass_assignment_security/permission_set.rb b/activemodel/lib/active_model/mass_assignment_security/permission_set.rb
>index a1fcdf1..10faa29 100644
>--- a/activemodel/lib/active_model/mass_assignment_security/permission_set.rb
>+++ b/activemodel/lib/active_model/mass_assignment_security/permission_set.rb
>@@ -19,7 +19,7 @@ module ActiveModel
>     protected
> 
>       def remove_multiparameter_id(key)
>-        key.to_s.gsub(/\(.+/, '')
>+        key.to_s.gsub(/\(.+/m, '')
>       end
>     end
> 
>-- 
>1.8.1.1
>

Actions: View | Diff

Attachments on bug 909528: 696260 | 696261 | 696262 | 696263