Skip to content

WIP; Fix carrierwave CVE-2023-49090 and CVE-2024-29034 #1416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

WIP; Fix carrierwave CVE-2023-49090 and CVE-2024-29034 #1416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 26 additions & 15 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ PATH
bazaar (~> 0.0.2)
bootstrap-kaminari-views (~> 0.0.5)
bootstrap-sass (~> 3.4.1)
carrierwave (~> 1.3.3)
carrierwave (~> 2.2.6)
carrierwave-mongoid (~> 1.4.0)
coffee-rails (~> 5.0)
custom_fields (~> 2.14.0.alpha1)
Expand Down Expand Up @@ -136,7 +136,7 @@ GEM
base64 (0.2.0)
bazaar (0.0.2)
bcrypt (3.1.20)
bigdecimal (3.1.4)
bigdecimal (3.1.7)
bindex (0.8.1)
bootstrap-kaminari-views (0.0.5)
kaminari (>= 0.13)
Expand All @@ -155,11 +155,14 @@ GEM
rack-test (>= 0.6.3)
regexp_parser (>= 1.5, < 3.0)
xpath (~> 3.2)
carrierwave (1.3.4)
activemodel (>= 4.0.0)
activesupport (>= 4.0.0)
mime-types (>= 1.16)
ssrf_filter (~> 1.0, < 1.1.0)
carrierwave (2.2.6)
activemodel (>= 5.0.0)
activesupport (>= 5.0.0)
addressable (~> 2.6)
image_processing (~> 1.1)
marcel (~> 1.0.0)
mini_mime (>= 0.1.3)
ssrf_filter (~> 1.0)
carrierwave-mongoid (1.4.0)
carrierwave (>= 0.8, < 3)
mongoid (>= 3.0, < 9.0)
Expand All @@ -173,7 +176,7 @@ GEM
execjs
coffee-script-source (1.12.2)
colorize (1.1.0)
concurrent-ruby (1.2.2)
concurrent-ruby (1.2.3)
connection_pool (2.4.1)
crass (1.0.6)
custom_fields (2.14.0.alpha1)
Expand Down Expand Up @@ -204,8 +207,7 @@ GEM
addressable (~> 2.3)
multi_json (~> 1.0)
rack (>= 1.3)
drb (2.2.0)
ruby2_keywords
drb (2.2.1)
dry-core (1.0.1)
concurrent-ruby (~> 1.0)
zeitwerk (~> 2.6)
Expand Down Expand Up @@ -255,8 +257,11 @@ GEM
httparty (0.16.4)
mime-types (~> 3.0)
multi_xml (>= 0.5.2)
i18n (1.14.1)
i18n (1.14.4)
concurrent-ruby (~> 1.0)
image_processing (1.12.2)
mini_magick (>= 4.9.5, < 5)
ruby-vips (>= 2.0.17, < 3)
io-console (0.6.0)
irb (1.11.0)
rdoc
Expand Down Expand Up @@ -334,12 +339,13 @@ GEM
net-smtp
marcel (1.0.2)
matrix (0.4.2)
mime-types (3.5.1)
mime-types (3.5.2)
mime-types-data (~> 3.2015)
mime-types-data (3.2023.1003)
mime-types-data (3.2024.0305)
mimetype-fu (0.1.2)
mini_magick (4.12.0)
mini_mime (1.1.5)
minitest (5.20.0)
minitest (5.22.3)
moneta (1.6.0)
monetize (1.12.0)
money (~> 6.12)
Expand Down Expand Up @@ -374,6 +380,8 @@ GEM
net-smtp (0.4.0)
net-protocol
nio4r (2.6.0)
nokogiri (1.14.5-arm64-darwin)
racc (~> 1.4)
nokogiri (1.14.5-x86_64-darwin)
racc (~> 1.4)
origin (2.3.1)
Expand Down Expand Up @@ -470,6 +478,8 @@ GEM
rspec-mocks (~> 3.12)
rspec-support (~> 3.12)
rspec-support (3.12.1)
ruby-vips (2.2.1)
ffi (~> 1.12)
ruby2_keywords (0.0.5)
rubyzip (2.3.2)
sanitize (6.0.2)
Expand Down Expand Up @@ -514,7 +524,7 @@ GEM
actionpack (>= 5.2)
activesupport (>= 5.2)
sprockets (>= 3.0.0)
ssrf_filter (1.0.8)
ssrf_filter (1.1.2)
stringex (2.8.6)
stringio (3.0.9)
temple (0.10.3)
Expand Down Expand Up @@ -545,6 +555,7 @@ GEM
zeitwerk (2.6.12)

PLATFORMS
arm64-darwin-22
x86_64-darwin-22

DEPENDENCIES
Expand Down
2 changes: 1 addition & 1 deletion app/uploaders/locomotive/picture_uploader.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
module Locomotive
class PictureUploader < BaseUploader

def extension_whitelist
def extension_allowlist
%w(jpg jpeg gif png tiff)
end

Expand Down
2 changes: 1 addition & 1 deletion app/uploaders/locomotive/theme_asset_uploader.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ def store_dir
self.build_store_dir('sites', model.site_id, 'theme', model.folder)
end

def extension_whitelist
def extension_allowlist
%w(jpg jpeg gif png css js swf flv mp4 eot svg svgz ttf ttc woff woff2 otf ico htc map html cur txt xml json ogv webm)
end

Expand Down
2 changes: 1 addition & 1 deletion locomotivecms.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,5 +72,5 @@ Gem::Specification.new do |s|
s.add_dependency 'grape', '~> 1.5.3'
s.add_dependency 'grape-entity', '~> 0.10.0'

s.add_dependency 'carrierwave', '~> 1.3.3'
s.add_dependency 'carrierwave', '~> 2.2.6'
end