CVE-2013-5036 (Ruby, published 2014-05-27T14:55Z)
Description: value: The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/SquareSquash/web
Files changed:
Gemfile.d/development.rb
Gemfile.d/utilities.rb
Gemfile.lock
app/assets/javascripts/application.js
app/controllers/api/v1_controller.rb
app/controllers/bugs_controller.rb
app/controllers/occurrences_controller.rb
app/controllers/sessions_controller.rb
app/models/additions/ldap_authentication.rb
app/models/blame.rb
app/models/bug.rb
app/models/environment.rb
app/models/event.rb
app/models/observers/comment_observer.rb
app/models/occurrence.rb
app/models/slug.rb
app/models/symbolication.rb
app/models/user.rb
config/application.rb
config/environment.rb
config/preinitializers/safe_yaml.rb
Commit message: CodeClimate-recommended security fixes


Vulnerable code:
    font-awesome-rails (3.1.1.2)
    hike (1.2.2)
    jquery-rails (3.0.0)
    multi_json (1.7.5)
    rake (10.0.4)
    stringex (2.0.2)
    treetop (1.4.12)
//= require jquery-ui
    map = YAML.load(Zlib::Inflate.inflate(Base64.decode64(params['namespace'])))
    sourcemap = YAML.load(Zlib::Inflate.inflate(Base64.decode64(params['sourcemap'])))
                SORT_DIRECTIONS.include?(params[:dir].upcase) ? params[:dir] : default_dir
        dir = 'desc' unless SORT_DIRECTIONS.include?(dir.try(:upcase))
  skip_before_filter :login_required, except: :destroy
            format:   {with: /[0-9a-f]+/}
            format:    {with: /[0-9a-f]+/},
            format:   {with: /[0-9a-f]+/}
            format:     {with: /[a-z0-9\-_]+/}
    Event.create! bug_id: comment.bug_id, kind: 'comment', data: {'comment_id' => comment.id}, user_id: comment.user_id
  attr_readonly :bug, :revision, :number, :occurred_at

            format:   {with: /[0-9a-f]+/}
      copy            = new_bug.occurrences.build
      copy.attributes = attributes.except('number', 'id', 'bug_id')
            format:     {with: /^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$/i}
            format:     {with: /[a-z0-9_\-]+/},
    # config.active_record.whitelist_attributes = true
Dir.glob(File.expand_path('../preinitializers/**/*.rb', __FILE__)).each { |f| require f }


Fixed code:

  gem 'json-schema', '< 2.0.0' # version 2.0 breaks fdoc

gem 'safe_yaml'
    font-awesome-rails (3.2.1.1)
    hike (1.2.3)
    jquery-rails (3.0.1)
    multi_json (1.7.7)
    rake (10.1.0)
    safe_yaml (0.9.3)
    stringex (2.0.3)
    treetop (1.4.14)
  json-schema (< 2.0.0)
  safe_yaml
    map = YAML.load(Zlib::Inflate.inflate(Base64.decode64(params['namespace'])), safe: true, deserialize_symbols: false)
    sourcemap = YAML.load(Zlib::Inflate.inflate(Base64.decode64(params['sourcemap'])), safe: true, deserialize_symbols: false)
                SORT_DIRECTIONS.include?(params[:dir].upcase) ? params[:dir].upcase : default_dir
        dir = 'DESC' unless SORT_DIRECTIONS.include?(dir.try(:upcase))
  skip_before_filter :login_required, only: [:new, :create]
  extend ActiveSupport::Concern

  included do
    attr_accessible :first_name, :last_name, as: :system
  end
            format:   {with: /\A[0-9a-f]+\z/}
            format:    {with: /\A[0-9a-f]+\z/},
            format:   {with: /\A[0-9a-f]+\z/}
            format:     {with: /\A[a-z0-9\-_]+\z/}
  attr_accessible :bug, :user, :kind, :data
    Event.create! do |event|
      event.bug_id  = comment.bug_id
      event.kind    = 'comment'
      event.data    = {'comment_id' => comment.id}
      event.user_id = comment.user_id
    end
  attr_accessible :revision, :occurred_at, :client, :crashed, *metadata_column_fields.keys
  attr_readonly :bug, :revision, :number, :occurred_at

            format:   {with: /\A[0-9a-f]+\z/}
      copy = new_bug.occurrences.build
      copy.assign_attributes attributes.except('number', 'id', 'bug_id'),
                             without_protection: true
  attr_accessible :sluggable, :slug, :active, :scope

            format:     {with: /\A[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\z/i}
            format:     {with: /\A[a-z0-9_\-]+\z/},
# Load preinitializers
Dir.glob(File.expand_path('../preinitializers/**/*.rb', __FILE__)).each { |f| require f }

    config.active_record.whitelist_attributes = true
# Let's make SafeYAML act exactly like YAML by default, to avoid surprising
# behavior.
SafeYAML::OPTIONS[:default_mode]        = :unsafe
SafeYAML::OPTIONS[:deserialize_symbols] = true

# And let's whitelist the things we transmit over YAML
SafeYAML.whitelist! Squash::Javascript::SourceMap, Squash::Java::Namespace