Skip to content

fix YAML safe load capatibility potential error - #3231

Merged
pengyin-shan merged 4 commits into
developmentfrom
add_symbol_to_safe_yaml_list
Nov 29, 2022
Merged

fix YAML safe load capatibility potential error#3231
pengyin-shan merged 4 commits into
developmentfrom
add_symbol_to_safe_yaml_list

Conversation

@pengyin-shan

Copy link
Copy Markdown
Contributor

Fixes a possible error caused by a bug in Rails. Some users see this error when moving the 'Download' tab:
image

Rails proposed the solution: https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017

Thus, made the following changes:

  • Make sure to upgrade to Rails 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1 (needs to be done separately by each team)
  • In the configuration file, add trusted resources (DMP Assistant has seen a bug from Symbol. HashwithDifferentAccess, Date and Time are also trusted and should be added)
  • I'm using an M2 Mac so Gemfile.lock got updated with the arm64 version there

@briri briri left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good @pengyin-shan

What do you mean by "when moving the 'Download' tab"? I haven't seen any issues with this in DMPTool Rails 6.1.

@pengyin-shan

Copy link
Copy Markdown
Contributor Author

Looks good @pengyin-shan

What do you mean by "when moving the 'Download' tab"? I haven't seen any issues with this in DMPTool Rails 6.1.

So this occurred for some user groups (so far DMP Assisant has only seen one user has this problem). I meant to use click 'Download' tab. i.e. User tried to download the plan, but the error message will show and bring the user back to their dashboard

@pengyin-shan

Copy link
Copy Markdown
Contributor Author

Looks good @pengyin-shan
What do you mean by "when moving the 'Download' tab"? I haven't seen any issues with this in DMPTool Rails 6.1.

So this occurred for some user groups (so far DMP Assisant has only seen one user has this problem). I meant to use click 'Download' tab. i.e. User tried to download the plan, but the error message will show and bring the user back to their dashboard

As an update, I moved separate settings from the configuration file to application.rb, since we need all environment following this rule

@pengyin-shan
pengyin-shan merged commit a814d68 into development Nov 29, 2022
@pengyin-shan
pengyin-shan deleted the add_symbol_to_safe_yaml_list branch November 29, 2022 23:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

2 participants