Attachment 831790 Details for Bug 1036910 – Upstream patch for 3.2.x

[patch] Upstream patch for 3.2.x

3-2-number_to_currency_xss.patch (text/plain), 2.83 KB, created by Tomas Hoger on 2013-12-02 21:47:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2013-12-02 21:47:28 UTC

Size: 2.83 KB

patch

obsolete

>From 015fab69f597de2ff909ec7a7a07f7fa0007f4d9 Mon Sep 17 00:00:00 2001
>From: Michael Koziarski <michael@koziarski.com>
>Date: Wed, 13 Nov 2013 16:14:07 +1300
>Subject: [PATCH] Escape the unit value provided to number_to_currency
>
>Fixes CVE-2013-6415
>
>Previously the values were trusted blindly allowing for potential XSS attacks.
>---
> actionpack/lib/action_view/helpers/number_helper.rb | 2 +-
> actionpack/test/template/number_helper_test.rb      | 7 ++++---
> 2 files changed, 5 insertions(+), 4 deletions(-)
>
>diff --git a/actionpack/lib/action_view/helpers/number_helper.rb b/actionpack/lib/action_view/helpers/number_helper.rb
>index ad86d13..eee9e59 100644
>--- a/actionpack/lib/action_view/helpers/number_helper.rb
>+++ b/actionpack/lib/action_view/helpers/number_helper.rb
>@@ -156,7 +156,7 @@ module ActionView
> 
>         begin
>           value = number_with_precision(number, options.merge(:raise => true))
>-          format.gsub(/%n/, value).gsub(/%u/, unit).html_safe
>+          format.gsub(/%n/, ERB::Util.html_escape(value)).gsub(/%u/, ERB::Util.html_escape(unit)).html_safe
>         rescue InvalidNumberError => e
>           if options[:raise]
>             raise
>diff --git a/actionpack/test/template/number_helper_test.rb b/actionpack/test/template/number_helper_test.rb
>index 37ce3cf..22da7e2 100644
>--- a/actionpack/test/template/number_helper_test.rb
>+++ b/actionpack/test/template/number_helper_test.rb
>@@ -43,10 +43,11 @@ class NumberHelperTest < ActionView::TestCase
>     assert_equal("($1,234,567,890.50)", number_to_currency(-1234567890.50, {:negative_format => "(%u%n)"}))
>     assert_equal("$1,234,567,892", number_to_currency(1234567891.50, {:precision => 0}))
>     assert_equal("$1,234,567,890.5", number_to_currency(1234567890.50, {:precision => 1}))
>-    assert_equal("&pound;1234567890,50", number_to_currency(1234567890.50, {:unit => "&pound;", :separator => ",", :delimiter => ""}))
>+    assert_equal("&pound;1234567890,50", number_to_currency(1234567890.50, {:unit => raw("&pound;"), :separator => ",", :delimiter => ""}))
>+    assert_equal("&amp;pound;1234567890,50", number_to_currency(1234567890.50, {:unit => "&pound;", :separator => ",", :delimiter => ""}))
>     assert_equal("$1,234,567,890.50", number_to_currency("1234567890.50"))
>-    assert_equal("1,234,567,890.50 K&#269;", number_to_currency("1234567890.50", {:unit => "K&#269;", :format => "%n %u"}))
>-    assert_equal("1,234,567,890.50 - K&#269;", number_to_currency("-1234567890.50", {:unit => "K&#269;", :format => "%n %u", :negative_format => "%n - %u"}))
>+    assert_equal("1,234,567,890.50 K&#269;", number_to_currency("1234567890.50", {:unit => raw("K&#269;"), :format => "%n %u"}))
>+    assert_equal("1,234,567,890.50 - K&#269;", number_to_currency("-1234567890.50", {:unit => raw("K&#269;"), :format => "%n %u", :negative_format => "%n - %u"}))
>   end
> 
>   def test_number_to_percentage
>-- 
>1.8.3.4
>

Actions: View | Diff

Attachments on bug 1036910: 831790 | 831792