Update addressable to address CVE-2021-32740

[rickychilcott]

See https://nvd.nist.gov/vuln/detail/CVE-2021-32740

Fixed in https://github.com/sporkmonger/addressable/commits/addressable-2.8.0

[arpitjalan]

Looking at:

Regular Expression Denial of Service in Addressable templates · Advisory · sporkmonger/addressable (github.com)

and

sporkmonger/addressable@b48ff03

I checked our source code and verified that onebox is not vulnerable here because this CVE only affects Addressable::Template component which we are not using anywhere. We only use Addressable::URI for parsing URLs.

That said, I see no harm in merging this PR. Thanks @rickychilcott! 👍🏼

[rickychilcott]

Thank you so much @techapj. This was to fix an upstream gem which is in my project.

I appreciate the quick merge. Do you plan to cut a new gem version?

[SamSaffron]

Hi Ricky, I don’t think it is needed, we were not vulnerable, and people can just update the dependency locally with a bundle update

…

On Tue, 13 Jul 2021 at 8:59 pm, Ricky Chilcott ***@***.***> wrote: Thank you so much @techapj <https://github.com/techAPJ>. This was to fix an upstream gem which is in my project. I appreciate the quick merge. Do you plan to cut a new gem version? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#479 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAABIXMNXRJA6L76XXMS2VLTXQMCBANCNFSM5AHXQBZA> .

[rickychilcott]

Thanks, Sam.

[rickychilcott]

Hi again. I would like a gem version to be cut, if possible. The reason is that I don't use onebox directly, it's a dependency of https://github.com/thredded/thredded which my project uses.

I can add an entry to my Gemfile (such as gem "onebox", github: "discourse/onebox", branch: "master"). This will give me the latest addressable gem and allow me to remove my bundler audit warning, but most will have to track back through the dependency graph to figure out how to do that.

If you cut a new release, users of onebox (which are using it as part of a 3rd party engine or gem) won't have to add the onbox entry to their Gemfile.

I'm fine for now, myself, but this could cause issues for others. Thank you for considering.

Related to thredded/thredded#893

[arpitjalan]

Onebox gem v2.2.18 has been published: https://rubygems.org/gems/onebox/versions/2.2.18.

[rickychilcott]

Thank you!