[Security] Bump activestorage from 5.2.3 to 6.1.3.2

[dependabot-preview]

Bumps activestorage from 5.2.3 to 6.1.3.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Circumvention of file size limits in ActiveStorage There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.

Patched versions: ~> 5.2.4, >= 5.2.4.3; >= 6.0.3.1 Unaffected versions: none

Sourced from The Ruby Advisory Database.

Circumvention of file size limits in ActiveStorage There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.

Patched versions: ~> 5.2.4.3; >= 6.0.3.1 Unaffected versions: none

Release notes

Sourced from activestorage's releases.

6.1.3.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Prevent open redirects by correctly escaping the host allow list CVE-2021-22903

• Prevent catastrophic backtracking during mime parsing CVE-2021-22902

• Prevent regex DoS in HTTP token authentication CVE-2021-22904

• Prevent string polymorphic route arguments.

  url_for supports building polymorphic URLs via an array of arguments (usually symbols and records). If a developer passes a user input array, strings can result in unwanted route helper calls.

  CVE-2021-22885

  Gannon McGibbon

Active Job

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 6.1.3.2 (May 05, 2021)

• No changes.

Rails 6.1.3.1 (March 26, 2021)

• Marcel is upgraded to version 1.0.0 to avoid a dependency on GPL-licensed mime types data.

  George Claghorn

Rails 6.1.3 (February 17, 2021)

• No changes.

Rails 6.1.2.1 (February 10, 2021)

• No changes.

Rails 6.1.2 (February 09, 2021)

• No changes.

Rails 6.1.1 (January 07, 2021)

• Fix S3 multipart uploads when threshold is larger than file.

  Matt Muller

Rails 6.1.0 (December 09, 2020)

• Change default queue name of the analysis (:active_storage_analysis) and purge (:active_storage_purge) jobs to be the job adapter's default (:default).

  Rafael Mendonça França

• Implement strict_loading on ActiveStorage associations.

  David Angulo

• Remove deprecated support to pass :combine_options operations to ActiveStorage::Transformers::ImageProcessing.

  Rafael Mendonça França

... (truncated)

Commits

• 75ac626 Preparing for 6.1.3.2 release
• 9c21201 Prep for release
• 85c6823 v6.1.3.1
• 853d594 Upgrade to Marcel 1.0.0
• 7c55e37 Replace mimemagic with mini_mime
• 5aaaa16 Preparing for 6.1.3 release
• 130c128 Preparing for 6.1.2.1 release
• bf8c59c Preparing for 6.1.2 release
• 1514745 Resolve conflict
• 5181300 Restore ActiveStorage::Blob#find_signed
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #189.