Ruby on Rails v8.1.4.1 and v8.0.5.2 released!

[NewsBot]

Ruby on Rails v8.1.4.1 and v8.0.5.2 has been released.

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe
  ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an
  in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now
  serialized with an unsafe marker and deserialized as a String. Earlier
  versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a
  LoadError message as a literal string instead of building a Regexp
  from it.

  The name’s segments were interpolated unescaped into the pattern, so input
  that reaches safe_constantize, such as the channel identifier in an Action
  Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a
  string.

  A Symbol such as :" " is not blank, because Symbol#blank? is
  Symbol#empty?, so it reached the escaping step and produced an attribute
  with no name. The asset helpers symbolize their keys, so an ordinary String
  key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

• Fix strip_tags to encode " and ' in its output.

  strip_tags returns an html_safe string, but was not encoding quotation
  marks. The method now encodes all five HTML-significant characters (&,
  <, >, ", '), consistent with the existing html_safe convention.

  Output used outside HTML, such as in a text template or JSON, now contains
  " and ' where it contained " and '. CGI.unescapeHTML
  decodes them.

  [GHSA-rq8q-p985-fjq7]

  *Mike Dalessio…

Link: Release 8.1.4.1 · rails/rails · GitHub

Active Support

• ActiveSupport::Inflector#safe_constantize matches the constant name in a
  LoadError message as a literal string instead of building a Regexp
  from it.

  The name’s segments were interpolated unescaped into the pattern, so input
  that reaches safe_constantize, such as the channel identifier in an Action
  Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a
  string.

  A Symbol such as :" " is not blank, because Symbol#blank? is
  Symbol#empty?, so it reached the escaping step and produced an attribute
  with no name. The asset helpers symbolize their keys, so an ordinary String
  key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

• Fix strip_tags to encode " and ' in its output.

  strip_tags returns an html_safe string, but was not encoding quotation
  marks. The method now encodes all five HTML-significant characters (&,
  <, >, ", '), consistent with the existing html_safe convention.

  Output used outside HTML, such as in a text template or JSON, now contains
  " and ' where it contained " and '. CGI.unescapeHTML
  decodes them.

  [GHSA-rq8q-p985-fjq7]

  Mike Dalessio

• Escape the matched phrase before substituting it into highlight’s
  :highlighter.

  A match was copied into each \1 of the highlighter as it appeared in
  the sanitized text, which keeps " and ' as they are, so a match
  containing a quote ended a quoted attribute value such as the
  documented '<a href="search?q=\1">\1</a>' and added attributes of
  its own. Each substituted group now goes through
  ERB::Util.html_escape_once, s…

Link: Release 8.0.5.2 · rails/rails · GitHub