There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

data = cache.fetch("demo", raw: true) { untrusted_string }

Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.

In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds

It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

0.3.5 (from changelog)

Mimetype extensions are now ordered by freedesktop.org's priority

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 2 commits:

• v0.3.5
• Mimetype extensions are now ordered by freedesktop.org's priority

See the full diff on Github. The new version differs by 6 commits:

• prepped for release
• + Minitest.filter_backtrace returns original backtrace if filter comes back empty.
• Refactored positive spec tests w/ a custom assertion.
• + Return true on a successful refute. (jusleg)
• Updated rake specs for latest assertions.
• - Fixed expectation doco to not use global expectations.

See the full diff on Github. The new version differs by 10 commits:

• Preparing for 5.2.4.3 release
• updating changelog
• bumping version
• update changelog
• Check that request is same-origin prior to including CSRF token in XHRs
• HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
• activesupport: Deprecate Marshal.load on raw cache read in RedisCacheStore
• activesupport: Avoid Marshal.load on raw cache value in MemCacheStore
• Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
• Include Content-Length in signature for ActiveStorage direct upload

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)