Possible XSS Security Vulnerability in SafeBuffer#[]

Skip to first unread message

Aaron Patterson

Mar 1, 2012, 1:01:56 PM3/1/12
to rubyonrail...@googlegroups.com
There is a vulnerability in the SafeBuffer#[] in Ruby On Rails where unescaped safe buffers can be marked as safe.

Versions Affected: All.
Fixed Versions: 3.2.2, 3.1.4, 3.0.12

Due side effects of some optimizations in the String class, users that directly manipulate SafeBuffer objects via `[]` and other methods that return new instances of SafeBuffer may be inadvertently marked as HTML safe. All users running an affected release should either upgrade or use one of the work arounds immediately.

This problem manifests itself in forms like this:

x = 'foo'.html_safe
x.html_safe? # => true
x.gsub!('f', 'user input').html_safe? # => false
x[0..-1].html_safe? # => true

Or in a shorter form:

'foo'.html_safe.gsub!('f', 'user input')[0..-1].html_safe? # => true

The fix will make the call to `html_safe?` return a falsey value. After the patch:

x = 'foo'.html_safe
x.html_safe? # => true
x.gsub!('f', 'user input').html_safe? # => false
x[0..-1].html_safe? # => nil

Or in a shorter form:

'foo'.html_safe.gsub!('f', 'user input')[0..-1].html_safe? # => nil

The 3.2.2, 3.1.4, and 3.0.12 releases are available at the normal locations.


There are no feasible workarounds for this issue.

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 3-2-safe-buffer-slice.patch - Patch for 3.2 series
* 3-1-safe-buffer-slice.patch - Patch for 3.1 series
* 3-0-safe-buffer-slice.patch - Patch for 3.0 series

Please note that only the 3.2.x, 3.1.x, and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.


Credit goes to Akira Matsuda for this fix. Thank you!

Aaron Patterson

Reply all
Reply to author
0 new messages