Rails ships 8.0.5.2 and 8.1.4.1 with four security fixes

Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage rails/rails

Direct uploads to Google Cloud Storage could bypass file size limits, one of the four fixes in 8.0.5.2 and 8.1.4.1. If your upload path goes through GCS, the patch is the mitigation, not a config change.

Possible DoS vulnerability in Active Storage filename handling rails/rails

Filename handling in Active Storage carried a DoS risk and is fixed in the same pair of releases. The other two patches in that release close an Action Pack content negotiation cache poisoning path and an Active Storage GCS upload limit gap.

Possible cache poisoning in Action Pack content negotiation rails/rails

Cached responses keyed through content negotiation could be poisoned. Any app sitting behind a shared cache should treat the 8.0.5.2 / 8.1.4.1 upgrade as the fix; there is no separate backport in the release.

Merge pull request #243 from rails/card-934-release-v1-7-2 rails/rails-html-sanitizer

by Mike Dalessio

Version 1.7.2 closes GHSA-cpgf-5mjf-73p7 and GHSA-h7wh-q2qr-458c. Bump the gem directly if you sanitize user HTML outside the Rails upgrade path.

Scrub SVG href attributes in linear time rails/rails-html-sanitizer

by Mike Dalessio

The SVG href and xlink:href check ran a regex whose `^` matched every line start against an all-whitespace value, rescanning the whole run from each start and going quadratic. The same scrub now runs in linear time, which is the ReDoS half of the 1.7.2 fix.

doc: end support for the 1.6.x and 1.5.x branches rails/rails-html-sanitizer

by Mike Dalessio

The README support matrix had no 1.7.x row and still listed 1.6.x and 1.5.x. Rails 6.1 is out of security support, and the Rails series still in it, 8.0 and 8.1, accept rails-html-sanitizer 1.7.

Ship an ImageMagick security policy for every MiniMagick process rails/rails

by Mike Dalessio

An uploaded SVG reached ImageMagick's `MSL` coder through the analyzer at attach time, and MSL reads and writes whatever files its script names; the release now ships a `policy.xml` for every MiniMagick process. Anything that attaches untrusted images should take this even if it has to defer the rest of the upgrade.

Honor unless_exist and avoid double compression in MemCacheStore#write_multi rails/rails

by kehra

The Dalli set_multi path added earlier ignored `:unless_exist`, so write_multi overwrote existing keys, and passed `:compress` through so already-compressed payloads could be compressed twice. If you rely on write_multi for add-only semantics, the store now honors them.