Rails ships 8.0.5.2 and 8.1.4.1 with an ImageMagick policy and four security fixes

Ship an ImageMagick security policy for every MiniMagick process rails/rails

by Mike Dalessio

An uploaded SVG reached ImageMagick's MSL coder through the analyzer at attach time, and Active Storage constrained none of ImageMagick's coders. Rails now ships a policy.xml that denies MSL, the other coders that touch files, the network, a display and Ghostscript, plus @filename indirection, and prepends its directory to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env.

Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage rails/rails

Direct uploads to Google Cloud Storage could circumvent file size limits.

Possible DoS vulnerability in Active Storage filename handling rails/rails

Filename handling in Active Storage opened a possible denial of service.

Possible cache poisoning in Action Pack content negotiation rails/rails

Action Pack's content negotiation carried a possible cache poisoning path.

Select each queue once when several entries in the list match it rails/solid_queue

by Rosa Gutierrez

Elsewhere, Solid Queue fixed queue-list matching so a worker listing queue_* and queue_b*, or queue_b* and queue_b1, no longer polls queue_b1 twice per pass and counts its jobs twice; queues -= matches only reassigned the block's local variable instead of removing the prefix matches. Related fixes return concurrency slots only to the semaphore that granted them and read the acquired semaphore w...