From 51bd0a9d5cf70e0f934a0bef62105f455a560383 Mon Sep 17 00:00:00 2001 From: pengyin-shan Date: Fri, 4 Nov 2022 12:19:38 -0400 Subject: [PATCH 1/2] fix YAML safe load capatibility potential error --- Gemfile.lock | 5 ++++- config/environments/development.rb | 4 ++++ config/environments/production.rb | 4 ++++ config/environments/test.rb | 4 ++++ db/schema.rb | 2 +- 5 files changed, 17 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 575e507936..993eeec238 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -268,6 +268,8 @@ GEM mysql2 (0.5.4) nenv (0.3.0) nio4r (2.5.8) + nokogiri (1.13.9-arm64-darwin) + racc (~> 1.4) nokogiri (1.13.9-x86_64-linux) racc (~> 1.4) notiffany (0.1.3) @@ -498,6 +500,7 @@ GEM zeitwerk (2.6.1) PLATFORMS + arm64-darwin-22 x86_64-linux DEPENDENCIES @@ -580,4 +583,4 @@ RUBY VERSION ruby 2.7.6p219 BUNDLED WITH - 2.3.15 + 2.3.25 diff --git a/config/environments/development.rb b/config/environments/development.rb index ade256c04b..5968bc09ee 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -82,6 +82,10 @@ # routes, locales, etc. This feature depends on the listen gem. config.file_watcher = ActiveSupport::EventedFileUpdateChecker + # CVE-2022-32224: add some compatibility with YAML.safe_load + # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer + config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] + # Uncomment if you wish to allow Action Cable access from any origin. # config.action_cable.disable_request_forgery_protection = true diff --git a/config/environments/production.rb b/config/environments/production.rb index 9d17aeffdc..a39e298cef 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -102,6 +102,10 @@ # Do not dump schema after migrations. config.active_record.dump_schema_after_migration = false + # CVE-2022-32224: add some compatibility with YAML.safe_load + # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer + config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] + # Inserts middleware to perform automatic connection switching. # The `database_selector` hash is used to pass options to the DatabaseSelector # middleware. The `delay` is used to determine how long to wait after a write diff --git a/config/environments/test.rb b/config/environments/test.rb index 7d008cd214..bb0460eca1 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -62,6 +62,10 @@ # config.action_view.annotate_rendered_view_with_filenames = true config.i18n.enforce_available_locales = false + + # CVE-2022-32224: add some compatibility with YAML.safe_load + # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer + config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] end # Used by Rails' routes url_helpers (typically when including a link in an email) diff --git a/db/schema.rb b/db/schema.rb index 56dbfef7d4..ae11e2f118 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -666,4 +666,4 @@ add_foreign_key "users", "departments" add_foreign_key "users", "languages" add_foreign_key "users", "orgs" -end +end \ No newline at end of file From 3e5c7c7d1d7615bb5608094dbbf1d84d64d1daa7 Mon Sep 17 00:00:00 2001 From: pengyin-shan Date: Fri, 4 Nov 2022 13:23:24 -0400 Subject: [PATCH 2/2] move common config setting to application.rb --- config/application.rb | 5 +++++ config/environments/development.rb | 4 ---- config/environments/production.rb | 4 ---- config/environments/test.rb | 4 ---- 4 files changed, 5 insertions(+), 12 deletions(-) diff --git a/config/application.rb b/config/application.rb index 2074f1f43d..8471b03c29 100644 --- a/config/application.rb +++ b/config/application.rb @@ -26,6 +26,11 @@ class Application < Rails::Application # --------------------------------- # # Ensure that Zeitwerk knows to load our classes in the lib directory config.eager_load_paths << config.root.join('lib') + + # CVE-2022-32224: add some compatibility with YAML.safe_load + # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer + config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] + # Have Zeitwerk skip generators because the generator templates are # incompatible with the Rails module/class naming conventions Rails.autoloaders.main.ignore(config.root.join('lib/generators')) diff --git a/config/environments/development.rb b/config/environments/development.rb index 5968bc09ee..ade256c04b 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -82,10 +82,6 @@ # routes, locales, etc. This feature depends on the listen gem. config.file_watcher = ActiveSupport::EventedFileUpdateChecker - # CVE-2022-32224: add some compatibility with YAML.safe_load - # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer - config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] - # Uncomment if you wish to allow Action Cable access from any origin. # config.action_cable.disable_request_forgery_protection = true diff --git a/config/environments/production.rb b/config/environments/production.rb index a39e298cef..9d17aeffdc 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -102,10 +102,6 @@ # Do not dump schema after migrations. config.active_record.dump_schema_after_migration = false - # CVE-2022-32224: add some compatibility with YAML.safe_load - # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer - config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] - # Inserts middleware to perform automatic connection switching. # The `database_selector` hash is used to pass options to the DatabaseSelector # middleware. The `delay` is used to determine how long to wait after a write diff --git a/config/environments/test.rb b/config/environments/test.rb index bb0460eca1..7d008cd214 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -62,10 +62,6 @@ # config.action_view.annotate_rendered_view_with_filenames = true config.i18n.enforce_available_locales = false - - # CVE-2022-32224: add some compatibility with YAML.safe_load - # Rails 5,6,7 are using YAML.safe_load as the default YAML deserializer - config.active_record.yaml_column_permitted_classes = [ActiveSupport::HashWithIndifferentAccess, Symbol, Date, Time] end # Used by Rails' routes url_helpers (typically when including a link in an email)