There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the j or escape_javascript methods
may be susceptible to XSS attacks.

Versions Affected: All.
Not affected: None.
Fixed Versions: 6.0.2.2, 5.2.4.2

Impact

There is a possible XSS vulnerability in the j and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:

<script>let a = `<%= j unknown_input %>`</script>

or

<script>let a = `<%= escape_javascript unknown_input %>`</script>

Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

Workarounds

For those that can't upgrade, the following monkey patch may be used:

ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
  {
    "`" => "\\`",
    "$" => "\\$"
  }
)
module ActionView::Helpers::JavaScriptHelper

alias :old_ej :escape_javascript

alias :old_j :j
def escape_javascript(javascript)

javascript = javascript.to_s

if javascript.empty?

result = ""

else

result = javascript.gsub(/(\|</|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)

end

javascript.html_safe? ? result.html_safe : result

end
alias :j :escape_javascript

end

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

See the full diff on Github. The new version differs by 17 commits:

• Merge pull request #64 from banister/release-1-0-0
• Release v1.0.0
• Merge pull request #63 from banister/travis-removal
• Test solely on CircleCI, remove Travis
• Merge pull request #62 from banister/circleci
• Test on CircleCI
• Merge pull request #61 from jasonkarns/patch-1
• More closely match MIT License text verbatim
• Merge pull request #59 from casperisfine/fix-ruby-2.7
• Test against Ruby 2.7 on CI
• Handle new message for unterminated lists on MRI 2.7
• Merge pull request #60 from casperisfine/fix-ci
• Fix ruby warning in spec_helper
• Add MRI 2.5 and 2.6
• Fix CI build
• Merge pull request #56 from nisusam/fix_documentation_link
• Fix `documentation` link

1.10.9

1.10.9 / 2020-03-01

Fixed

• [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
• [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @headius!)

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 5 commits:

• version bump to v1.10.9
• update CHANGELOG
• Change return type to RubyArray
• update CHANGELOG for #1985
• Work around a bug in libxml2

See the full diff on Github. The new version differs by 2 commits:

• update version
• Fix possible XSS vector in JS escape helper

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)