1. 23 7月, 2019 2 次提交
    • A
      Omit marshal_dump & _dump from delegate_missing_to · 056414eb
      Aaron Lipman 提交于
      Exclude missing marshal_dump and _dump methods from being delegated to
      an object's delegation target via the delegate_missing_to extension.
      This avoids unintentionally adding instance variables to an object
      during marshallization, should the delegation target be a method which
      would otherwise add them.
      
      In current versions of Ruby, a bug exists in the way objects are
      marshalled, allowing for instance variables to be added or removed
      during marshallization (see https://bugs.ruby-lang.org/issues/15968).
      This results in a corrupted serialized byte stream, causing an object's
      instance variables to "leak" into subsequent serialized objects during
      demarshallization.
      
      In Rails, this behavior may be triggered when marshalling an object that
      uses the delegate_missing_to extension, if the delegation target is a
      method which adds or removes instance variables to an object being
      marshalled - when calling Marshal.dump(object), Ruby's built in behavior
      will check whether the object responds to :marshal_dump or :_dump, which
      in turn triggers the delegation target method in the
      responds_to_missing? function defined in
      activesupport/lib/active_support/core_ext/module/delegation.rb
      
      While future versions of Ruby will resolve this bug by raising a
      RuntimeError, the underlying cause of this error may not be readily
      apparent when encountered by Rails developers. By excluding marshal_dump
      and _dump from being delegated to an object's target, this commit
      eliminates a potential cause of unexpected behavior and/or
      RuntimeErrors.
      
      Fixes #36522
      056414eb
    • R
      Merge pull request #36726 from Edouard-chin/ec-source-annotation-extractor-deprecation · 23d29c70
      Rafael França 提交于
      Move the deprecation call after the new class has been defined:
      23d29c70
  2. 20 7月, 2019 2 次提交
  3. 18 7月, 2019 1 次提交
  4. 17 7月, 2019 1 次提交
  5. 16 7月, 2019 7 次提交
  6. 15 7月, 2019 1 次提交
  7. 14 7月, 2019 2 次提交
    • J
      Update guide for render file: · c185f793
      John Hawthorn 提交于
      Most of this section was written from the time that render file: was the
      default, before CVE-2016-0752.
      
      This updates the guide to the Rails 6 `render file:` behaviour, moves it
      to a more appropriate part of the file.
      
      [ci skip]
      c185f793
    • J
      Remove obsolete or discouraged render examples · 211dd25e
      John Hawthorn 提交于
      Most of these examples no longer work. The ability to render an absolute
      path was removed as part of CVE-2016-0752. In Rails 6 we changed `render
      file:` to only take exact paths and always to render them as raw files.
      Rendering a template with its extensions _is_ supported, but I don't
      think should be recommended.
      
      This also removes `render file:` from an example where it isn't
      relevant.
      
      [ci skip]
      211dd25e
  8. 13 7月, 2019 6 次提交
  9. 12 7月, 2019 1 次提交
  10. 11 7月, 2019 6 次提交
  11. 09 7月, 2019 5 次提交
  12. 08 7月, 2019 4 次提交
  13. 07 7月, 2019 2 次提交