CVE-2023-0299 (Ruby, published 2023-01-14T15:15Z)
Description: value: Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/publify/publify
Files changed:
publify_core/Manifest.txt
publify_core/app/models/blog.rb
publify_core/app/models/concerns/string_length_limit.rb
publify_core/app/models/content.rb
publify_core/app/models/feedback.rb
publify_core/app/models/ping.rb
publify_core/app/models/post_type.rb
publify_core/app/models/redirect.rb
publify_core/app/models/resource.rb
publify_core/app/models/tag.rb
publify_core/app/models/user.rb
publify_core/spec/models/blog_spec.rb
publify_core/spec/models/content_spec.rb
publify_core/spec/models/feedback_spec.rb
publify_core/spec/models/ping_spec.rb
publify_core/spec/models/post_type_spec.rb
publify_core/spec/models/redirect_spec.rb
publify_core/spec/models/resource_spec.rb
publify_core/spec/models/tag_spec.rb
publify_core/spec/models/user_spec.rb
Commit message: Validate lengths of string attributes

When using the MySQL database, Rails automatically sets a limit of 255
characters for string columns. This changes ensures this limit is also
enforced in the validations. For several columns with a different limit,
that different limit is enforced instead.

For the PostgreSQL database, there is no limit in the database, but it
is useful to set a limit anyway to prevent absurdly large values from
being submitted.


Vulnerable code:
  describe "validation" do
      expect(blog.tags.build(name: "")).not_to be_valid

Fixed code:
app/models/concerns/string_length_limit.rb
  include StringLengthLimit

  validates_default_string_length :base_url
# frozen_string_literal: true

module StringLengthLimit
  # Default string length limit for model attributes. When running on MySQL,
  # this is equal to the default string length in the database as set by Rails.
  STRING_LIMIT = 255

  extend ActiveSupport::Concern

  class_methods do
    def validates_default_string_length(*names)
      names.each do |name|
        validates name, length: { maximum: STRING_LIMIT }
      end
    end
  end
end
  include StringLengthLimit
  validates_default_string_length :title, :author, :permalink, :name,
                                  :post_type, :text_filter_name

  include StringLengthLimit
  validates_default_string_length :title, :author, :email, :url, :blog_name,
                                  :user_agent, :text_filter_name

  validates :ip, length: { maximum: 40 }

  include StringLengthLimit

  validates_default_string_length :url
  include StringLengthLimit

  validates_default_string_length :name, :permalink, :description

  include StringLengthLimit

  validates_default_string_length :from_path, :to_path

  include StringLengthLimit

  validates_default_string_length :mime
  include StringLengthLimit

  validates_default_string_length :display_name
  include StringLengthLimit
  validates_default_string_length :email, :text_filter_name
    it "requires base url to not be too long" do
      expect(blog).to validate_length_of(:base_url).is_at_most(255)
    end


  describe "validations" do
    let(:content) { described_class.new }

    it "requires title to not be too long" do
      expect(content).to validate_length_of(:title).is_at_most(255)
    end

    it "requires author to not be too long" do
      expect(content).to validate_length_of(:author).is_at_most(255)
    end

    it "requires permalink to not be too long" do
      expect(content).to validate_length_of(:permalink).is_at_most(255)
    end

    it "requires name to not be too long" do
      expect(content).to validate_length_of(:name).is_at_most(255)
    end

    it "requires post_type to not be too long" do
      expect(content).to validate_length_of(:post_type).is_at_most(255)
    end

    it "requires text_filter_name to not be too long" do
      expect(content).to validate_length_of(:text_filter_name).is_at_most(255)
    end
  end

  describe "validations" do
    let(:feedback) { described_class.new }

    it "requires title to not be too long" do
      expect(feedback).to validate_length_of(:title).is_at_most(255)
    end

    it "requires author to not be too long" do
      expect(feedback).to validate_length_of(:author).is_at_most(255)
    end

    it "requires email to not be too long" do
      expect(feedback).to validate_length_of(:email).is_at_most(255)
    end

    it "requires url to not be too long" do
      expect(feedback).to validate_length_of(:url).is_at_most(255)
    end

    it "requires ip to not be too long" do
      expect(feedback).to validate_length_of(:ip).is_at_most(40)
    end

    it "requires blog_name to not be too long" do
      expect(feedback).to validate_length_of(:blog_name).is_at_most(255)
    end

    it "requires user_agent to not be too long" do
      expect(feedback).to validate_length_of(:user_agent).is_at_most(255)
    end

    it "requires text_filter_name to not be too long" do
      expect(feedback).to validate_length_of(:text_filter_name).is_at_most(255)
    end
  end
  describe "validations" do
    let(:ping) { described_class.new }

    it "requires url to not be too long" do
      expect(ping).to validate_length_of(:url).is_at_most(255)
    end
  end

  describe "validations" do
    let(:post_type) { described_class.new }

    it "requires name to not be too long" do
      expect(post_type).to validate_length_of(:name).is_at_most(255)
    end

    it "requires permalink to not be too long" do
      expect(post_type).to validate_length_of(:permalink).is_at_most(255)
    end

    it "requires description to not be too long" do
      expect(post_type).to validate_length_of(:description).is_at_most(255)
    end
  end

  describe "validations" do
    let(:redirect) { described_class.new }

    it "requires from_path to not be too long" do
      expect(redirect).to validate_length_of(:from_path).is_at_most(255)
    end

    it "requires to_path to not be too long" do
      expect(redirect).to validate_length_of(:to_path).is_at_most(255)
    end
  end

  describe "validations" do
    let(:resource) { described_class.new }

    it "requires mime to not be too long" do
      expect(resource).to validate_length_of(:mime).is_at_most(255)
    end
  end
  describe "validations" do
    let(:tag) { described_class.new }

      expect(tag).to validate_presence_of(:name)
    end

    it "requires display_name to not be too long" do
      expect(tag).to validate_length_of(:display_name).is_at_most(255)
    it "requires email to not be too long" do
      expect(user).to validate_length_of(:email).is_at_most(255)
    end

    it "requires text_filter_name to not be too long" do
      expect(user).to validate_length_of(:text_filter_name).is_at_most(255)
    end