Skip to content

Instantly share code, notes, and snippets.

@neilbartley

neilbartley/cve_2016_6316_workaround.rb

Last active November 17, 2017 20:42
Show Gist options
  • Save neilbartley/c0af4d16f210cd7de635437a7b2768ce to your computer and use it in GitHub Desktop.
Save neilbartley/c0af4d16f210cd7de635437a7b2768ce to your computer and use it in GitHub Desktop.
Download ZIP
Temporary (upgrade to Rails 4.2.7.1 / 5.0.0.1) workaround for CVE-2016-6316 (see: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk). Only tested with Rails 4.1. Place in config/initializers.
Raw
cve_2016_6316_workaround.rb
if Rails::VERSION::MINOR < 2 && Rails::VERSION::MAJOR >= 4
module ActionView
module Helpers
module TagHelper
private
def tag_option(key, value, escape)
value = value.join(" ") if value.is_a?(Array)
value = ERB::Util.h(value) if escape
%(#{key}="#{value.gsub(/"/, '&quot;'.freeze)}")
end
end
end
end
end
@pdx91
Copy link

pdx91 commented Nov 17, 2017

Any reason you used private to define that method when in Rails code it's not?
https://github.com/rails/rails/blob/master/actionview/lib/action_view/helpers/tag_helper.rb#L87

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment