From 9a48f4cf329f66682c34c86822d625d63dbb6919 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Sat, 9 Feb 2013 16:31:04 -0800 Subject: [PATCH] fixing attr_protected CVE-2013-0276 --- activerecord/lib/active_record/attribute_methods.rb | 2 +- activerecord/lib/active_record/base.rb | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/activerecord/lib/active_record/attribute_methods.rb b/activerecord/lib/active_record/attribute_methods.rb index 22630b3..5f0ca58 100644 --- a/activerecord/lib/active_record/attribute_methods.rb +++ b/activerecord/lib/active_record/attribute_methods.rb @@ -130,7 +130,7 @@ module ActiveRecord # Suffixes a, ?, c become regexp /(a|\?|c)$/ def rebuild_attribute_method_regexp suffixes = attribute_method_suffixes.map { |s| Regexp.escape(s) } - @@attribute_method_regexp = /(#{suffixes.join('|')})$/.freeze + @@attribute_method_regexp = /(#{suffixes.join('|')})\z/.freeze end # Default to =, ?, _before_type_cast diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb index cfc6e86..c11b702 100755 --- a/activerecord/lib/active_record/base.rb +++ b/activerecord/lib/active_record/base.rb @@ -2998,11 +2998,11 @@ module ActiveRecord #:nodoc: def remove_attributes_protected_from_mass_assignment(attributes) safe_attributes = if self.class.accessible_attributes.nil? && self.class.protected_attributes.nil? - attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) } + attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) } elsif self.class.protected_attributes.nil? - attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) } + attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/m, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) } elsif self.class.accessible_attributes.nil? - attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) } + attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/m,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) } else raise "Declare either attr_protected or attr_accessible for #{self.class}, but not both." end -- 1.8.1.1