Pullup ticket #4073 - requested by taca
databases/ruby-activerecord3: security patch
devel/ruby-activemodel: security patch

Revisions pulled up:
- databases/ruby-activerecord3/Makefile                         1.9
- databases/ruby-activerecord3/distinfo                         1.19-1.20
- databases/ruby-activerecord3/patches/patch-lib_active__record_attribute__methods_write.rb 1.1-1.2
- devel/ruby-activemodel/Makefile                               1.12
- devel/ruby-activemodel/distinfo                               1.19-1.20
- devel/ruby-activemodel/patches/patch-lib_active__model_attribute__methods.rb 1.1-1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Feb 12 13:23:20 UTC 2013

   Modified Files:
   	pkgsrc/databases/ruby-activerecord3: Makefile distinfo
   Added Files:
   	pkgsrc/databases/ruby-activerecord3/patches:
   	    patch-lib_active__record_attribute__methods_write.rb

   Log Message:
   Add fix for Fix for CVE-2013-0277.

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Feb 13 14:08:07 UTC 2013

   Modified Files:
   	pkgsrc/databases/ruby-activerecord3: distinfo
   	pkgsrc/databases/ruby-activerecord3/patches:
   	    patch-lib_active__record_attribute__methods_write.rb

   Log Message:
   Correct comment in a patch file.

   This change dosen't fix CVE-2013-0276 but give workaround for it.

   No PKGREVISION bump.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Feb 12 15:30:42 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-activemodel: Makefile distinfo
   Added Files:
   	pkgsrc/devel/ruby-activemodel/patches:
   	    patch-lib_active__model_attribute__methods.rb

   Log Message:
   Add fix for CVE-2013-0276.

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Feb 13 14:07:31 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-activemodel: distinfo
   	pkgsrc/devel/ruby-activemodel/patches:
   	    patch-lib_active__model_attribute__methods.rb

   Log Message:
   Correct comment in a patch file.

   This change dosen't fix CVE-2013-0276 but give workaround for it.

   No PKGREVISION bump.


(tron)

$NetBSD$

Workaround for CVE-2013-0277.

--- lib/active_record/attribute_methods/write.rb.orig	2013-02-12 00:08:22.000000000 +0000
+++ lib/active_record/attribute_methods/write.rb
@@ -10,7 +10,14 @@ module ActiveRecord
       module ClassMethods
         protected
           def define_method_attribute=(attr_name)
-            if attr_name =~ /^[a-zA-Z_]\w*[!?=]?$/
+            if self.serialized_attributes[attr_name]
+              generated_attribute_methods.send(:define_method, "#{attr_name}=") do |new_value|
+                if new_value.is_a?(String) and new_value =~ /^---/
+                  raise ActiveRecordError, "You tried to assign already serialized content to #{attr_name}. This is disabled due to security issues."
+                end
+                write_attribute(attr_name, new_value)
+              end
+            elsif attr_name =~ /^[a-zA-Z_]\w*[!?=]?$/
               generated_attribute_methods.module_eval("def #{attr_name}=(new_value); write_attribute('#{attr_name}', new_value); end", __FILE__, __LINE__)
             else
               generated_attribute_methods.send(:define_method, "#{attr_name}=") do |new_value|

$NetBSD$

Workaround for CVE-2013-0276.

--- lib/active_model/attribute_methods.rb.orig	2013-02-12 15:27:17.000000000 +0000
+++ lib/active_model/attribute_methods.rb
@@ -347,7 +347,7 @@ module ActiveModel
           def initialize(options = {})
             options.symbolize_keys!
             @prefix, @suffix = options[:prefix] || '', options[:suffix] || ''
-            @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/
+            @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/
           end
 
           def match(method_name)