Ruby on Rails 2.3.4: Security Fixes

Posted by michael September 04, 2009 @ 06:04 AM

We’ve released Ruby on Rails 2.3.4, this release fixes bugs and introduces a few minor features. Due to the inclusion of two security fixes, all users of the 2.3 series are recommended to upgrade as soon as possible.

Security Fixes

2.3.4 contains fixes for two security issues which were reported to us. For more details see the security announcements:

Bug Fixes

Thanks to the success of the BugMash we have around 100 bug fixes as part of this release. Of particular not is the fix to reloading problems related to rack middleware and rails metals when running in development mode.

New Features

  • Support for bundling I18n translations in plugins, Rails will now automatically add locale files found in any engine’s locale directory to the I18n.load_path. commit
  • Added db/seeds.rb as a default file for storing seed data for the database. Can be loaded with rake db:seed commit

39 comments

Comments

  1. David on 04 Sep 07:50:

    Just an FYI you have a misspelling (missing “e”) in the second sentence under Bug Fixes. “Of particular not(e)”

  2. dickstar on 04 Sep 07:55:

    I’m loving it. How to use the seeds.rb? Is any mannual?

  3. Jeroen on 04 Sep 08:05:

    I’m getting lots of deprecation warnings wrt ActiveRecord::Errors#generate_message:

    DEPRECATION WARNING: ActiveRecord::Errors#generate_message has been deprecated. Please use ActiveRecord::Error#generate_message.. (called from generate_message at /Users/jeroen/Projects/java/jruby-1.3.1/lib/ruby/gems/1.8/gems/activerecord-2.3.4/lib/active_record/validations.rb:324)

    Any ideas what is causing these warnings and what i have to change in my app?

  4. Jan on 04 Sep 08:05:

    Thanks for the hard work! My tests take about 15% more time to complete with 2.3.4 versus 2.3.3.

    Any ideas where the slowdown comes from?

  5. mikhailov on 04 Sep 08:09:

    Thanks, seems that the future of technology is really stunning!

  6. Lawrence on 04 Sep 10:58:

    @Jeroen I also got a ton of those deprecation warnings. For me this was because I was using the Remarkable gem which calls that method. It did this:

    model.errors.generate_message(attribute, message, :count => ‘12345’)

    I modified that to:

    ::ActiveRecord::Error.new(model, attribute, message, :count => ‘12345’).to_s

    and now I have no deprecation warnings anymore.

  7. Priit on 04 Sep 11:22:

    Does anybody else get similar error from migrating from rails 2.3.3 to 2.3.4:

    ActionView::TemplateError (undefined method `^’ for 1)

    It seems removing old cookie from browser fixes the bug however now I probably should force to clean all users cookies when they visit a site.

    Anyhow, db:seeds is nice new feature indeed!

  8. Jeroen on 04 Sep 11:25:

    @Lawrence Thanks! I’m also using the Remarkable gem. I suspected that that was causing the trouble.

  9. Henri on 04 Sep 12:40:

    Sounds great – always good to see kaizen in your framework of choice.

    I know this probably isn’t the place, but our team has been getting a few ‘uninitialized constant’ errors upon upgrade.. specifically Rails::Initializer::Digest for some devs and ActionController::AbstractResponse for others.

  10. stid on 04 Sep 12:47:

    @Priit,

    same error here, in my app it seems related to an incompatibility with authlogic (2.1.1).

    The error is generated by the new Timer Weakness patch.

    No way to get it works.

    Error log below:

    NoMethodError (undefined method `^’ for 6): authlogic (2.1.1) lib/authlogic/session/session.rb:54:in `update_session’ authlogic (2.1.1) lib/authlogic/session/callbacks.rb:75:in `after_persisting’ authlogic (2.1.1) lib/authlogic/session/persistence.rb:59:in `persisting?’ authlogic (2.1.1) lib/authlogic/session/persistence.rb:39:in `find’ app/controllers/application_controller.rb:184:in `current_user_session’ app/controllers/application_controller.rb:189:in `current_user’ app/controllers/application_controller.rb:193:in `require_user’ <internal:prelude>:8:in `synchronize’ /usr/local/lib/ruby/1.9.1/webrick/httpserver.rb:111:in `service’ /usr/local/lib/ruby/1.9.1/webrick/httpserver.rb:70:in `run’ /usr/local/lib/ruby/1.9.1/webrick/server.rb:183:in `block in start_thread’

  11. Bif on 04 Sep 12:49:

    Getting errors when attempting to update from Rails 2.3.3 to 2.3.4 on Windows

    D:\> gem update rails Updating installed gems Updating rails ERROR: While executing gem … (Zlib::BufError) buffer error

  12. Bif on 04 Sep 13:10:

    After 5 attempts, gem update succeeded… Don’t know if problem is intermittent or just my installation.

  13. Damien on 04 Sep 15:12:

    Thanks for this security fix. You also updated rubygems from 1.3.1 to 1.3.2. But in production in Debian, we can’t update rubygems if it’s installed via aptitude.

    Waiting for rubygems to be supported in this version by every packages systems should be a good idea.

  14. Travis Reeder on 04 Sep 19:50:

    This introduced a VERY severe bug as Pritt and Stid mentioned: https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/3144-undefined-method-for-string-ror-234

    Basically kills rails for Ruby 1.9. DO NOT UPGRADE TO 2.3.4 IF YOU ARE USING RUBY 1.9 or your app will becoming unusable.

  15. Andy on 04 Sep 21:34:

    Seems to break seed_fu with model names that end with “error”.

    Following now raises an error

    TestError.seed(:test_id, :error_id) do |f| f.test_id = 1 f.error_id = 1 end

    Here is output Seed from db/fixtures/test_error.rb ======================= rake aborted! undefined method `find’ for ActiveRecord::Error:Class
  16. Tom on 05 Sep 12:09:

    Thanks for the quick XSS fix :-)

  17. Robby Russell on 05 Sep 15:25:

    I posted a quick intro to a few ways that you can use the new seeds feature on my blog:

    • http://www.robbyonrails.com/articles/2009/09/05/planting-the-seeds
  18. doming on 05 Sep 16:14:

    I updated my app from rails 2.3.3 to rails 2.3.4. As a result, my app became very slow in view (100ms => 400~500ms). Does anyone have the same problem?

  19. tankwanghow on 05 Sep 18:52:

    Authlogic fail 2.3.4 seems to be related to ruby 1.9.1. I have the same problem when I update to 2.3.4 and ruby 1.9.1, but revert to ruby 1.8.7 with 2.3.4 the error did not happen.

  20. tanker on 05 Sep 20:43:

    This is a terrible and very irresponsible release.

    This release breaks any installation that is running on ruby 1.9 or above. Somebody did a really bad planing job here, how could you release something like during a US holiday weekend. WTF!

  21. doming on 05 Sep 20:44:

    @tankwanghow Oh, really? I use ruby 1.8.7 (and restful_authentication).

  22. tanker on 05 Sep 21:02:

    This is an outrageous issues which was introduced in the latest rails update.

    https://rails.lighthouseapp.com/projects/8994/tickets/3144

  23. Priit on 05 Sep 21:55:

    @stid: I get the same error with skeleton rails app as well, so the bug scope should be with new the secure_compare method at active_support/message_verifier.rb. I’ll try to investigate it a bit more later.

  24. Mukund on 07 Sep 05:57:

    sudo gem install rails—version “2.2.3” ERROR: could not find gem rails locally or in a repository

    What am I missing? Works for Rails 2.2.2

  25. PhilT on 08 Sep 18:15:

    Rock on with db:seed! I had something similar in my own code and we were about to pull it across into a production app! Cheers all.

  26. Mike Mondragon on 08 Sep 21:04:

    If your app is running on Phussion Passenger make sure your Apache is using the latest Passenger 2.2.5 gem if you redeploy with Rails 2.3.4 frozen into your app otherwise you will see some weird 500’s with a stack trace looking like:

    Status: 500 Internal Server Error undefined method `rewind’ for IO

    (or UNIXSocket)

  27. Diego Algorta on 09 Sep 01:11:

    I second Mukund on the complain here. Gem package for announced 2.2.3 version can’t be found anywhere.

  28. Fitz on 09 Sep 15:03:

    Thank you so much Priit!!! It took me ages to find that all I needed to do to get rid of the weird `^’ error was to clear the cookies for the site! I am in your debt!

  29. Fitz on 09 Sep 15:35:

    It turns out that clearing the cookies only fixes the error until the session is written to again. As soon as rails tries to access the session to corrupt information breaks the applciation again. Anyone have any ideas on this? Running rails 2.3.4

  30. Fitz on 09 Sep 16:19:

    Ok, so there is a patch available for this issue. For anyone else struggling with this problem you can find the patch here:

    https://rails.lighthouseapp.com/projects/8994/tickets/3144/a/261015/0001-ruby-1.9-friendly-secure_compare.patch

    I have tested this and the problem is fixed in my environment. Hope this saves someone else a headache!

    Running rails 2.3.4 with ruby 1.9

  31. Michael Economy on 09 Sep 17:33:

    This patch adds significant load. Perhaps it could be rewritten in a way that would allow high traffic sites to use it?

    doing: >> 10000.times {ActiveSupport::Multibyte.clean(“dfgasdfgafshadfhafdhadfhadfhafd”)}

    takes roughly 3 seconds on my macbook pro…

  32. CTKT on 15 Sep 18:43:

    Fitz – the secure_compare.patch is exactly what I need, I think. But I have no idea how to apply it. I need to apply it to my local windows and to our suse linux server.

    Does anyone have a good “how to apply a RoR patch”?

    Thanks!

  33. Karsten Meier on 18 Sep 16:13:

    There are some small things left for announcing the new release:

    The Ruby On Rails home page still talks about Version 2.3.3 as newest version.

    There are fine release notes, but they are hard to find on the ROR webpage (when I don’t go over this blog page) I think they should be linked somewhere on the “documentation” page: http://rubyonrails.org/documentation

  34. Don Park on 18 Sep 22:46:

    Its shocking to see a release has not yet happened. rails 2.3.4 has a show-stopping bug for ruby 1.9, (which ruby-lang.org promotes as the standard ruby), reported in lighthouse (#3144) on the day 2.3.4 was released and 14 days later there is no 2.3.4.1 or 2.3.5 yet.

  35. Michael Economy on 23 Sep 01:07:

    @Don agreed!

  36. Eloy Duran on 23 Sep 14:02:

    @Michael Seriously? Perhaps some “high-traffic site” maintainer could rewrite it to work as they would expect.

    Because with “high-traffic” you are implying that it’s not a toy, which, if the case, means that you are asking people who are not making any revenue of this site to fix it for the people that do.

    That my friend, is the world upside down.

    Also: https://rails.lighthouseapp.com/projects/8994/tickets/3158-multibyte-cleanup-cleanup-performance-and-readability

    Please pay your respects to the people making this all possible or contribute yourself, instead of whining.

    </two>
  37. chirag shah on 24 Sep 10:13:

    Nice to see the rails 2.3.4

    There is not any information about rails 2.3.4 in the http://rubyonrails.org/

  38. Zac Zheng on 01 Oct 09:12:

    I am trying to find the ticket for the “fix to reloading problems related to rack middleware and rails metals”.

    Dug around but couldn’t find it on https://rails.lighthouseapp.com. Does anyone know the ticket number?

  39. Gabriel Maculus on 03 Oct 03:55:

    I reverted my rails to 2.3.3 with:

    gem install -v 2.3.3

    using gem install—version=”2.3.3” cause broken pipe ERROR: While executing gem … (Gem::RemoteFetcher::FetchError) Errno::EPIPE: Broken pipe (http://gems.rubyforge.org/gems/actionmailer-2.3.3.gem)