Attachment 831819 Details for Bug 1036922 – Upstream patch for 4.0.x

[patch] Upstream patch for 4.0.x

4-0-i18n_xss.patch (text/plain), 3.77 KB, created by Tomas Hoger on 2013-12-02 22:23:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2013-12-02 22:23:22 UTC

Size: 3.77 KB

patch

obsolete

>From 71da3e0ef4c9d0048d8a56e7029fb4145f6e9db3 Mon Sep 17 00:00:00 2001
>From: Michael Koziarski <michael@koziarski.com>
>Date: Fri, 1 Nov 2013 11:50:05 +1300
>Subject: [PATCH] Stop using i18n's built in HTML error handling.
>
>i18n doesn't depend on active support which means it can't use our html_safe
>code to do its escaping when generating the spans.  Rather than try to sanitize
>the output from i18n, just revert to our old behaviour of rescuing the error
>and constructing the tag ourselves.
>
>Fixes: CVE-2013-4491
>---
> .../lib/action_view/helpers/translation_helper.rb  | 22 +++++++++-------------
> .../test/template/translation_helper_test.rb       |  2 +-
> 2 files changed, 10 insertions(+), 14 deletions(-)
>
>diff --git a/actionpack/lib/action_view/helpers/translation_helper.rb b/actionpack/lib/action_view/helpers/translation_helper.rb
>index ad8eb47..a1a2beb 100644
>--- a/actionpack/lib/action_view/helpers/translation_helper.rb
>+++ b/actionpack/lib/action_view/helpers/translation_helper.rb
>@@ -1,24 +1,14 @@
> require 'action_view/helpers/tag_helper'
> require 'i18n/exceptions'
> 
>-module I18n
>-  class ExceptionHandler
>-    include Module.new {
>-      def call(exception, locale, key, options)
>-        exception.is_a?(MissingTranslation) && options[:rescue_format] == :html ? super.html_safe : super
>-      end
>-    }
>-  end
>-end
>-
> module ActionView
>   # = Action View Translation Helpers
>   module Helpers
>     module TranslationHelper
>       # Delegates to <tt>I18n#translate</tt> but also performs three additional functions.
>       #
>-      # First, it'll pass the <tt>rescue_format: :html</tt> option to I18n so that any
>-      # thrown +MissingTranslation+ messages will be turned into inline spans that
>+      # First, it will ensure that any thrown +MissingTranslation+ messages will be turned 
>+      # into inline spans that:
>       #
>       #   * have a "translation-missing" class set,
>       #   * contain the missing key as a title attribute and
>@@ -44,8 +34,11 @@ module ActionView
>       # naming convention helps to identify translations that include HTML tags so that
>       # you know what kind of output to expect when you call translate in a template.
>       def translate(key, options = {})
>-        options.merge!(:rescue_format => :html) unless options.key?(:rescue_format)
>         options[:default] = wrap_translate_defaults(options[:default]) if options[:default]
>+
>+        # If the user has specified rescue_format then pass it all through, otherwise use
>+        # raise and do the work ourselves
>+        options[:raise] = true unless options.key?(:raise) || options.key?(:rescue_format)
>         if html_safe_translation_key?(key)
>           html_safe_options = options.dup
>           options.except(*I18n::RESERVED_KEYS).each do |name, value|
>@@ -59,6 +52,9 @@ module ActionView
>         else
>           I18n.translate(scope_key_by_partial(key), options)
>         end
>+      rescue I18n::MissingTranslationData => e
>+        keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
>+        content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
>       end
>       alias :t :translate
> 
>diff --git a/actionpack/test/template/translation_helper_test.rb b/actionpack/test/template/translation_helper_test.rb
>index d496dbb..0dfe47f 100644
>--- a/actionpack/test/template/translation_helper_test.rb
>+++ b/actionpack/test/template/translation_helper_test.rb
>@@ -31,7 +31,7 @@ class TranslationHelperTest < ActiveSupport::TestCase
>   end
> 
>   def test_delegates_to_i18n_setting_the_rescue_format_option_to_html
>-    I18n.expects(:translate).with(:foo, :locale => 'en', :rescue_format => :html).returns("")
>+    I18n.expects(:translate).with(:foo, :locale => 'en', :raise=>true).returns("")
>     translate :foo, :locale => 'en'
>   end
> 
>-- 
>1.8.3.4
>

Actions: View | Diff

Attachments on bug 1036922: 831807 | 831819