diff options
| author | taca <taca> | 2013-02-12 13:23:20 +0000 |
|---|---|---|
| committer | taca <taca> | 2013-02-12 13:23:20 +0000 |
| commit | 24e0329d0961e4dd0e2611738e4daa1ee436ebd7 (patch) | |
| tree | c8b6f43bec17017d454a9bb8823592709db0dd12 | |
| parent | f8f70b8869e8a35dd81f3cce1a2b5610b5f3afdb (diff) | |
| download | pkgsrc-24e0329d0961e4dd0e2611738e4daa1ee436ebd7.tar.gz | |
Add fix for Fix for CVE-2013-0277.
Bump PKGREVISION.
| -rw-r--r-- | databases/ruby-activerecord3/patches/patch-lib_active__record_attribute__methods_write.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/databases/ruby-activerecord3/patches/patch-lib_active__record_attribute__methods_write.rb b/databases/ruby-activerecord3/patches/patch-lib_active__record_attribute__methods_write.rb new file mode 100644 index 00000000000..47fd718d8a8 --- /dev/null +++ b/databases/ruby-activerecord3/patches/patch-lib_active__record_attribute__methods_write.rb @@ -0,0 +1,22 @@ +$NetBSD$ + +Fix for CVE-2013-0277. + +--- lib/active_record/attribute_methods/write.rb.orig 2013-02-12 00:08:22.000000000 +0000 ++++ lib/active_record/attribute_methods/write.rb +@@ -10,7 +10,14 @@ module ActiveRecord + module ClassMethods + protected + def define_method_attribute=(attr_name) +- if attr_name =~ /^[a-zA-Z_]\w*[!?=]?$/ ++ if self.serialized_attributes[attr_name] ++ generated_attribute_methods.send(:define_method, "#{attr_name}=") do |new_value| ++ if new_value.is_a?(String) and new_value =~ /^---/ ++ raise ActiveRecordError, "You tried to assign already serialized content to #{attr_name}. This is disabled due to security issues." ++ end ++ write_attribute(attr_name, new_value) ++ end ++ elsif attr_name =~ /^[a-zA-Z_]\w*[!?=]?$/ + generated_attribute_methods.module_eval("def #{attr_name}=(new_value); write_attribute('#{attr_name}', new_value); end", __FILE__, __LINE__) + else + generated_attribute_methods.send(:define_method, "#{attr_name}=") do |new_value| |