CVE-2020-25739: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-09-23T14:15Z
Repository: https://github.com/gazay/gon
Language: Ruby
Files changed: .travis.yml, CHANGELOG.md, gon.gemspec, lib/gon/json_dumper.rb, lib/gon/version.rb
Commit date: 2020-09-18 10:00:12 -0700
Commit message: CVE-2020-25739: Enforce HTML entities escaping in gon output

Version 6.4.0

Diff: diff --git a/.travis.yml b/.travis.yml
index 669261d..8748e01 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,9 +4,11 @@ env:
   - "RABL_GEM=rabl"
   - "RABL_GEM=rabl-rails"
 
 rvm:
   - 2.2.10
-  - 2.3.7
-  - 2.4.4
-  - 2.5.1
+  - 2.3.8
+  - 2.4.10
+  - 2.5.8
+  - 2.6.6
+  - 2.7.1
   - ruby-head
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c43fa4e..a4ac4c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,13 @@
 # CHANGELOG
 
 ## [Unreleased]
 
+## [6.4.0] - 2020-09-18
+### Security
+- CVE-2020-25739: Enforce HTML entities escaping in gon output
+
 ## [6.3.2] - 2019-11-18
 ### Security
 - Restrict possibility of vulnerable i18n legacy verision (0.3.6.pre)
   installation
 
diff --git a/gon.gemspec b/gon.gemspec
index 5b17e54..676d7d4 100644
--- a/gon.gemspec
+++ b/gon.gemspec
@@ -25,6 +25,7 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'rspec', '>= 3.0'
   s.add_development_dependency 'jbuilder'
   s.add_development_dependency 'railties', '>= 3.0.20'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'pry'
+  s.add_development_dependency 'pry-byebug'
 end
diff --git a/lib/gon/json_dumper.rb b/lib/gon/json_dumper.rb
index 0df6fd5..950439d 100644
--- a/lib/gon/json_dumper.rb
+++ b/lib/gon/json_dumper.rb
@@ -1,8 +1,23 @@
 class Gon
   module JsonDumper
+    # Taken from ERB::Util
+    JSON_ESCAPE_REGEXP	=	/[\u2028\u2029&><]/u
+    JSON_ESCAPE	=	{
+      "&" => '\u0026',
+      ">" => '\u003e',
+      "<" => '\u003c',
+      "\u2028" => '\u2028',
+      "\u2029" => '\u2029'
+    }
+
     def self.dump(object)
-      MultiJson.dump object,
+      dumped_json = MultiJson.dump object,
         mode: :compat, escape_mode: :xss_safe, time_format: :ruby
+      escape(dumped_json)
+    end
+
+    def self.escape(json)
+      json.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
     end
   end
 end
diff --git a/lib/gon/version.rb b/lib/gon/version.rb
index 1b528e0..96ab1b2 100644
--- a/lib/gon/version.rb
+++ b/lib/gon/version.rb
@@ -1,3 +1,3 @@
 class Gon
-  VERSION = '6.3.2'
+  VERSION = '6.4.0'
 end

Vulnerable code:   - 2.3.7
  - 2.4.4
  - 2.5.1
      MultiJson.dump object,
  VERSION = '6.3.2'
Fixed code:   - 2.3.8
  - 2.4.10
  - 2.5.8
  - 2.6.6
  - 2.7.1
## [6.4.0] - 2020-09-18
### Security
- CVE-2020-25739: Enforce HTML entities escaping in gon output

  s.add_development_dependency 'pry-byebug'
    # Taken from ERB::Util
    JSON_ESCAPE_REGEXP	=	/[\u2028\u2029&><]/u
    JSON_ESCAPE	=	{
      "&" => '\u0026',
      ">" => '\u003e',
      "<" => '\u003c',
      "\u2028" => '\u2028',
      "\u2029" => '\u2029'
    }

      dumped_json = MultiJson.dump object,
      escape(dumped_json)
    end

    def self.escape(json)
      json.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
  VERSION = '6.4.0'