$ the-wire · showcase
rails-html-sanitizer 1.7.2 patches XSS and ReDoS
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
rails-html-sanitizer 1.7.2 ships fixes for two advisories, GHSA-cpgf-5mjf-73p7 and GHSA-h7wh-q2qr-458c, and ends support for the 1.5.x and 1.6.x branches.
Merge pull request #243 from rails/card-934-release-v1-7-2 rails/rails-html-sanitizer
The 1.7.2 release carries the security fixes for GHSA-cpgf-5mjf-73p7, a possible XSS via shared scrubber state in concurrent calls, and GHSA-h7wh-q2qr-458c. Any app that sanitizes HTML on more than one thread should be running 1.7.2.
Scrub SVG href attributes in linear time rails/rails-html-sanitizer
PermitScrubber#scrub_attribute tested SVG href and xlink:href against a regexp that went quadratic on all-whitespace values: a 20 KB attribute took 3.4 seconds on Ruby 3.1.7. Ruby 3.2's linear-time regexp matching hid the problem, so only Ruby 3.1 and earlier are exposed, and the fix switches to Loofah::HTML5::Scrub.prefixed_attribute_name.
doc: end support for the 1.6.x and 1.5.x branches rails/rails-html-sanitizer
The README and CHANGELOG now mark the 1.6.x and 1.5.x branches unsupported and add a 1.7.x row. Rails 6.1 is out of security support, and the Rails series still in it, 8.0 and 8.1, accept rails-html-sanitizer 1.7 and require Ruby >= 3.2.
Honor unless_exist and avoid double compression in MemCacheStore#write_multi rails/rails
The Dalli set_multi path ignored :unless_exist, so write_multi overwrote existing keys, and it forwarded :compress to Dalli, so payloads the store had already compressed could be compressed again. MemCacheStore#write_multi now falls back to per-entry writes using Dalli's add when :unless_exist is true and drops :compress before calling set_multi.
Merge pull request #59516 from kehra/unscope-default-order rails/rails
ActiveRecord::Relation#unscope(:default_order) now removes a relation's default ordering while leaving explicit ordering in place. Elsewhere, the Markdown directive cleanup in Active Record, Active Support, and Railties, Propshaft dropping EOL Ruby 3.1 and 3.2 from CI and fixing its gem-versus-app asset path ordering, solid_cable's inline broadcaster, and a routine benchmark gem removal from bu...
Action items
- → Upgrade rails-html-sanitizer to 1.7.2 to pick up the fixes for GHSA-cpgf-5mjf-73p7 and GHSA-h7wh-q2qr-458c rails/rails-html-sanitizer [immediate]
