$ the-wire · showcase
ActionText to_markdown delimiter escapes leave stored XSS, vips boot fixes land
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
2 people shipped this
Two fixes from the Rails security queue land the same day: ActionText::MarkdownConversion leaks unescaped code and pre content through broken delimiters, and the vips boot regression that has blocked mini_magick applications since 8.1.3.1 is corrected.
ActionText::MarkdownConversion lists code and pre in SKIP_ESCAPING_PARENTS, so their text is emitted without Markdown escaping, and safety rests entirely on the delimiter visit_code or visit_pre wraps around the content. Nothing checked that the delimiter holds [1]. Seven positions break it, including a blank line inside a code span, which Trix encodes as <br><br>: press return twice inside a code block and a link such as [click](javascript:alert(1)) survives as live Markdown. A further review found five more breaks [5], among them a pre under a table row rather than a cell, a pre in an ordered list item whose later lines were indented two spaces under a three-column marker, and code content starting with whitespace that kramdown will not open a one-backtick span for. This is a stored XSS path through ordinary authoring in Trix, and it is a breaking change to the conversion output, since content that previously passed through unescaped is now wrapped correctly.
The vips story is two related fixes. Since cd0a2588 (released in 8.1.3.1), loading active_storage/vips at boot raised whenever ruby-vips was installed but libvips or ruby-vips was too old to block the unfuzzed loaders, which stopped :mini_magick applications from booting even though Active Storage never hands them content through libvips [2]. The fix keeps loading ruby-vips and calling Vips.block_untrusted(true) at boot for every processor, and raises only where libvips is actually used. Separately, an application with the ruby-vips gem installed but no libvips could not start at all: ruby-vips loads glib before libvips, so the LoadError names glib-2.0 rather than either name active_storage/vips matched against, and the re-raised error aborted boot for every variant processor [3].
On the test side, test_render_notifications_are_silenced_outside_debug_mode [4] errored because its branch predated the replacement of this file's Rails.root stubbing with StructuredEventSubscriber.rails_root. The stale merge restored the file's only Rails.stub(:root, ...), and Minitest::Mock#stub refuses to stub a method the receiver does not respond to, which Action View's test environment does not define. The stub is removed rather than reintroduced.
The rails/website commits update schedule.yml, lingua-clanka.md, and mike-dalessio.md [6][7][8]. No release is attached to any of them.
Action items
- → Audit any application rendering untrusted Trix content through ActionText::MarkdownConversion for code and pre blocks before your next deploy rails/rails [immediate]
- → Upgrade past 8.1.3.1 if you use :mini_magick, which could fail to boot on the unsecurable-libvips check rails/rails [immediate]
- → Verify boot succeeds if you have ruby-vips installed without system libvips rails/rails [plan]
References
- [1] to_markdown code/pre content escapes its delimiter (stored XSS) ↗ rails/rails
- [2] Boot with an unsecurable libvips unless the processor uses it ↗ rails/rails
- [3] Boot when ruby-vips cannot load its libraries ↗ rails/rails
- [4] Don't stub Rails.root in a new Action View test (#58753) ↗ rails/rails
- [5] Close five more `to_markdown` delimiter breaks ↗ rails/rails
- [6] Update schedule.yml ↗ rails/website
- [7] Update lingua-clanka.md ↗ rails/website
- [8] Update mike-dalessio.md ↗ rails/website
