1. 29 11月, 2018 5 次提交
  2. 28 11月, 2018 7 次提交
    • Y
      Remove duplicated test · 44fc9383
      yuuji.yaginuma 提交于
      Since 06ab7b27,
      `GCSServiceTest#test_signed_URL_response_headers` is broken.
      https://travis-ci.org/rails/rails/jobs/460454477#L7084-L7087
      
      This seems to be due to lack of `content_type` at upload.
      This is solved by specifying `conten_type`.
      
      However, since the same content is also tested with `test_upload_with_content_type`,
      it will be duplicated content, so I think that can remove `test_signed_URL_response_headers`.
      44fc9383
    • Y
      text is treated as `attachment` · b9c56648
      yuuji.yaginuma 提交于
      b9c56648
    • R
      Merge branch '5-2-sec' into 5-2-stable · f1b2732a
      Rafael Mendonça França 提交于
      f1b2732a
    • R
      Merge pull request #34528 from DmitryTsepelev/fix-ignored-attributes · 446bc026
      Rafael França 提交于
      Additional types of ResultSet should not contain keys of #attributes_to_define_after_schema_loads
      446bc026
    • R
      Preparing for 5.2.1.1 release · 96dee0e7
      Rafael Mendonça França 提交于
      96dee0e7
    • R
      Prevent content type and disposition bypass in storage service URLs · 54ed6ad8
      Rosa Gutierrez 提交于
      * Force content-type to binary on service urls for relevant content types
      
      We have a list of content types that must be forcibly served as binary,
      but in practice this only means to serve them as attachment always. We
      should also set the Content-Type to the configured binary type.
      
      As a bonus: add text/cache-manifest to the list of content types to be
      served as binary by default.
      
      * Store content-disposition and content-type in GCS
      
      Forcing these in the service_url when serving the file works fine for S3
      and Azure, since these services include params in the signature.
      However, GCS specifically excludes response-content-disposition and
      response-content-type from the signature, which means an attacker can
      modify these and have files that should be served as text/plain attachments
      served as inline HTML for example. This makes our attempt to force
      specific files to be served as binary and as attachment can be easily
      bypassed.
      
      The only way this can be forced in GCS is by storing
      content-disposition and content-type in the object metadata.
      
      * Update GCS object metadata after identifying blob
      
      In some cases we create the blob and upload the data before identifying
      the content-type, which means we can't store that in GCS right when
      uploading. In these, after creating the attachment, we enqueue a job to
      identify the blob, and set the content-type.
      
      In other cases, files are uploaded to the storage service via direct
      upload link. We create the blob before the direct upload, which happens
      independently from the blob creation itself. We then mark the blob as
      identified, but we have already the content-type we need without having
      put it in the service.
      
      In these two cases, then, we need to update the metadata in the GCS
      service.
      
      * Include content-type and disposition in the verified key for disk service
      
      This prevents an attacker from modifying these params in the service
      signed URL, which is particularly important when we want to force them
      to have specific values for security reasons.
      
      * Allow only a list of specific content types to be served inline
      
      This is different from the content types that must be served as binary
      in the sense that any content type not in this list will be always
      served as attachment but with its original content type. Only types in
      this list are allowed to be served either inline or as attachment.
      
      Apart from forcing this in the service URL, for GCS we need to store the
      disposition in the metadata.
      
      Fix CVE-2018-16477.
      54ed6ad8
    • R
      Do not deserialize GlobalID objects that were not generated by Active Job · 970b0d75
      Rafael Mendonça França 提交于
      Trusting any GlobaID object when deserializing jobs can allow
      attackers to access information that should not be accessible to them.
      
      Fix CVE-2018-16476.
      970b0d75
  3. 27 11月, 2018 1 次提交
  4. 26 11月, 2018 1 次提交
  5. 25 11月, 2018 3 次提交
  6. 24 11月, 2018 1 次提交
  7. 23 11月, 2018 1 次提交
  8. 22 11月, 2018 1 次提交
  9. 21 11月, 2018 1 次提交
  10. 20 11月, 2018 1 次提交
  11. 17 11月, 2018 3 次提交
  12. 14 11月, 2018 3 次提交
  13. 02 11月, 2018 2 次提交
  14. 01 11月, 2018 2 次提交
  15. 31 10月, 2018 2 次提交
    • S
      Fix failing test · 0ebbd063
      Sean Griffin 提交于
      b63701e2 moved the assignment before the query, but we need to capture
      our old id before assignment in case we are assigning the id.
      0ebbd063
    • S
      `update_columns` raises if the column is unknown · 7a183bd5
      Sean Griffin 提交于
      Previosly, `update_columns` would just take whatever keys you gave it
      and tried to run the update query. Most likely this would result in an
      error from the database. However, if the column actually did exist, but
      was in `ignored_columns`, this would result in the method returning
      successfully when it should have raised, and an attribute that should
      not exist written to `@attributes`.
      7a183bd5
  16. 29 10月, 2018 2 次提交
  17. 27 10月, 2018 1 次提交
  18. 25 10月, 2018 2 次提交
  19. 24 10月, 2018 1 次提交