Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Bump brakeman from 4.6.1 to 4.7.1 #12329

Merged
merged 1 commit into from Nov 8, 2019

Conversation

@dependabot-preview
Copy link
Contributor

dependabot-preview bot commented Nov 8, 2019

Bumps brakeman from 4.6.1 to 4.7.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

brakeman world writable files allow local privilege escalation
The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
privilege escalation because of world-writable files. For example,
if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
a local user can insert malicious code into the
ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.

Patched versions: >= 4.7.1
Unaffected versions: <= 4.4.0

Release notes

Sourced from brakeman's releases.

4.7.1

  • Sort text report by file and line (Jacob Evelyn)
  • Catch reverse tabnabbing with :_blank symbol (Jacob Evelyn)
  • Convert s(:lambda) to s(:call) in Sexp#block_call (#1410)
  • Check string length against limit before joining
  • Fix flaky rails4 test (Adam Kiczula)
  • Fix errors from frozen Symbol#to_s in Ruby 2.7
  • Add release dates to each version in CHANGES (TheSpartan1980)

4.7.0

Changelog

Sourced from brakeman's changelog.

4.7.1 - 2019-10-29

  • Check string length against limit before joining
  • Fix errors from frozen Symbol#to_s in Ruby 2.7
  • Fix flaky rails4 test (Adam Kiczula)
  • Added release dates to each version in CHANGES (TheSpartan1980)
  • Catch reverse tabnabbing with :_blank symbol (Jacob Evelyn)
  • Convert s(:lambda) to s(:call) in Sexp#block_call
  • Sort text report by file and line (Jacob Evelyn)

4.7.0 - 2019-10-16

  • Refactor Brakeman::Differ#second_pass (Benoit Côté-Jodoin)
  • Ignore interpolation in %W[]
  • Fix version_between? (Andrey Glushkov)
  • Add support for ruby_parser 3.14.0
  • Ignore form_for for XSS check
  • Update Haml support to Haml 5.x
  • Catch shell injection from -c shell commands (Jacob Evelyn)
  • Correctly handle non-symbols in CheckCookieSerialization (Phil Turnbull)
Commits
  • b2efd59 Bump to 4.7.1
  • 46fcb34 Update CHANGES
  • 23232f6 Merge pull request #1421 from presidentbeef/check_string_length_first
  • 3f24340 Merge pull request #1420 from presidentbeef/symbol_to_s_2_7_0
  • 23c017a Symbol#to_s returns frozen string in Ruby 2.7.0
  • 25fad31 Merge pull request #1419 from adamkiczula/fix_flaky_test
  • bfc6471 Fix flaky rails4 test
  • 1cf56ca Merge pull request #1418 from TheSpartan1980/release-dates
  • e0d1ff7 Update CHANGES.md
  • da1cd50 Merge pull request #1411 from JacobEvelyn/master
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

  • Update frequency
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)
Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 4.6.1 to 4.7.1. **This update includes a security fix.**
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/master/CHANGES.md)
- [Commits](presidentbeef/brakeman@v4.6.1...v4.7.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
@ykzts
ykzts approved these changes Nov 8, 2019
@ykzts ykzts merged commit 05ae908 into master Nov 8, 2019
2 checks passed
2 checks passed
build-and-test Workflow: build-and-test
Details
codeclimate All good!
Details
@dependabot-preview dependabot-preview bot deleted the dependabot/bundler/brakeman-4.7.1 branch Nov 8, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.