The NetBSD Project

CVS log for pkgsrc/www/ruby-actionpack32/Attic/distinfo

[BACK] Up to [cvs.NetBSD.org] / pkgsrc / www / ruby-actionpack32

Request diff between arbitrary revisions


Default branch: MAIN
Current tag: pkgsrc-2012Q3


Revision 1.6 / (download) - annotate - [select for diffs], Sun Aug 12 12:40:00 2012 UTC (6 years, 10 months ago) by taca
Branch: MAIN
CVS Tags: pkgsrc-2012Q3-base, pkgsrc-2012Q3
Changes since 1.5: +4 -4 lines
Diff to previous 1.5 (colored)

Update ruby-actionpack32 to 3.2.8.

## Rails 3.2.8 (Aug 9, 2012) ##

* There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
  helper doesn't correctly handle malformed html.  As a result an attacker can
  execute arbitrary javascript through the use of specially crafted malformed
  html.

  *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*

* When a "prompt" value is supplied to the `select_tag` helper, the "prompt"
  value is not escaped.
  If untrusted data is not escaped, and is supplied as the prompt value, there
  is a potential for XSS attacks.
  Vulnerable code will look something like this:

    select_tag("name", options, :prompt => UNTRUSTED_INPUT)

  *Santiago Pastorino*

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>