CVE-2024-28103: Insufficient Information (NVD-CWE-noinfo)
value: Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2024-06-04T20:15Z
Repository: https://github.com/rails/rails
Language: Ruby
Files changed: actionpack/lib/action_dispatch/http/permissions_policy.rb, actionpack/test/dispatch/permissions_policy_test.rb
Commit date: 2024-06-04 10:07:37 -0700
Commit message: include the HTTP Permissions-Policy on non-HTML Content-Types

[CVE-2024-28103]

The application configurable Permissions-Policy is only
served on responses with an HTML related Content-Type.

This change allows all Content-Types to serve the
configured Permissions-Policy as there are many non-HTML
Content-Types that would benefit from this header.
(examples include image/svg+xml and application/xml)

Diff: diff --git a/actionpack/lib/action_dispatch/http/permissions_policy.rb b/actionpack/lib/action_dispatch/http/permissions_policy.rb
index 5ce30d9d75c..682bec187d8 100644
--- a/actionpack/lib/action_dispatch/http/permissions_policy.rb
+++ b/actionpack/lib/action_dispatch/http/permissions_policy.rb
@@ -35,11 +35,10 @@ def initialize(app)
       end
 
       def call(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         request = ActionDispatch::Request.new(env)
 
         if policy = request.permissions_policy
@@ -52,16 +51,10 @@ def call(env)
 
         response
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[Rack::CONTENT_TYPE]
-            content_type.include?("html")
-          end
-        end
-
         def policy_present?(headers)
           headers[ActionDispatch::Constants::FEATURE_POLICY]
         end
 
         def policy_empty?(policy)
diff --git a/actionpack/test/dispatch/permissions_policy_test.rb b/actionpack/test/dispatch/permissions_policy_test.rb
index 9239b12f6b9..6b3ef073ec2 100644
--- a/actionpack/test/dispatch/permissions_policy_test.rb
+++ b/actionpack/test/dispatch/permissions_policy_test.rb
@@ -67,16 +67,16 @@ def call(env)
     get "/index"
 
     assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]
   end
 
-  test "non-html requests will not set a policy" do
+  test "non-html requests will set a policy" do
     @app = build_app(->(env) { [200, { Rack::CONTENT_TYPE => "application/json" }, []] })
 
     get "/index"
 
-    assert_nil response.headers[ActionDispatch::Constants::FEATURE_POLICY]
+    assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]
   end
 
   test "existing policies will not be overwritten" do
     @app = build_app(->(env) { [200, { ActionDispatch::Constants::FEATURE_POLICY => "gyroscope 'none'" }, []] })
 

Vulnerable code:         return response unless html_response?(headers)
        def html_response?(headers)
          if content_type = headers[Rack::CONTENT_TYPE]
            content_type.include?("html")
          end
        end

  test "non-html requests will not set a policy" do
    assert_nil response.headers[ActionDispatch::Constants::FEATURE_POLICY]
Fixed code:   test "non-html requests will set a policy" do
    assert_equal "gyroscope 'self'", response.headers[ActionDispatch::Constants::FEATURE_POLICY]