Possible XSS Security Vulnerability in SafeBuffer#[]
Aaron Patterson
Versions Affected: All.
Fixed Versions: 3.2.2, 3.1.4, 3.0.12
Impact
------
Due side effects of some optimizations in the String class, users that directly manipulate SafeBuffer objects via `[]` and other methods that return new instances of SafeBuffer may be inadvertently marked as HTML safe. All users running an affected release should either upgrade or use one of the work arounds immediately.
This problem manifests itself in forms like this:
x = 'foo'.html_safe
x.html_safe? # => true
x.gsub!('f', 'user input').html_safe? # => false
x[0..-1].html_safe? # => true
Or in a shorter form:
'foo'.html_safe.gsub!('f', 'user input')[0..-1].html_safe? # => true
The fix will make the call to `html_safe?` return a falsey value. After the patch:
x = 'foo'.html_safe
x.html_safe? # => true
x.gsub!('f', 'user input').html_safe? # => false
x[0..-1].html_safe? # => nil
Or in a shorter form:
'foo'.html_safe.gsub!('f', 'user input')[0..-1].html_safe? # => nil
Releases
--------
The 3.2.2, 3.1.4, and 3.0.12 releases are available at the normal locations.
Workarounds
-----------
There are no feasible workarounds for this issue.
Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
* 3-2-safe-buffer-slice.patch - Patch for 3.2 series
* 3-1-safe-buffer-slice.patch - Patch for 3.1 series
* 3-0-safe-buffer-slice.patch - Patch for 3.0 series
Please note that only the 3.2.x, 3.1.x, and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.
Credits
-------
Credit goes to Akira Matsuda for this fix. Thank you!
--
Aaron Patterson
http://tenderlovemaking.com/