[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <44661A02-48C2-4985-8E14-F7D58E2D2490@tigrish.com>
Date: Thu, 5 Dec 2013 18:15:36 +0100
From: Christopher Dell <chris@...rish.com>
To: kseifried@...hat.com
Cc: oss-security@...ts.openwall.com,
ruby-security-ann@...glegroups.com,
rubyonrails-security@...glegroups.com,
tenderlove@...y-lang.org,
"mattaimonetti@...il.com Aimonetti" <mattaimonetti@...il.com>,
clemens@...lway.at,
jose.valim@...il.com,
stephan.soller@...ionweb.de,
saimonmoore@...il.com,
me@...nfuchs.com
Subject: Re: Re: [CVE-2013-4491] Reflective XSS Vulnerability in Ruby on Rails
Hello everyone,
Just to clarify I18n.enforce_available_locales quickly, when I18n initialises, it creates an array of the known locales called I18n.available_locales.
Typically, this array is created by scanning for YML files (in config/locales for a Rails app).
With I8n.enforce_available_locales set to true, we check that the locale we're trying to use (eg. translate or localize) is included in the available_locales. This means we're certain it can't be malicious user submitted data even outside of the scope of a Rails app.
I could really use a hand with the CVE announcements, I literally have no idea about any of this!
Cheers,
-- Chris
PS. Including Sven's correct email address.
On Dec 3, 2013, at 22:54 PM, Kurt Seifried <kseifried@...hat.com> wrote:
> Signed PGP part
> On 12/03/2013 02:32 PM, kpolitowicz@...onik.ca wrote:
> > Thanks. But what's the deal with I18n.enforce_available_locales ?
> >
>
> That's a good question, the technical side of which I would point you at:
>
> http://rubygems.org/gems/i18n
>
> The latest release fixes security stuff, however they don't do CVE
> announcements/ChangeLog anywhere I can see. Adding them to this email
> CC. Guys, if you need help drafting a security announcements I'd be
> glad to help.
>
> --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
Content of type "text/html" skipped
Download attachment "signature.asc" of type "application/pgp-signature" (497 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
