Package Instance

view_component - Preview Route Can Dispatch Inherited Helper Methods'
The preview route derives an example name from the URL and calls it
with `public_send`. The code does not verify that the requested
method is one of the preview examples explicitly defined by the
preview class.

As a result, inherited public methods on `ViewComponent::Preview`
are route-reachable. The most important one is `render_with_template`,
which accepts `template:` and `locals:`. Those values can come from
request params and are later passed to Rails as `render template:`.

If previews are exposed, an attacker can render internal Rails
templates that are not otherwise routable.

Severity: High if preview routes are externally reachable; Medium otherwise.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.

view_component - System Test Entry Point Path Check Allows Sibling Directory Escape
The system test entrypoint canonicalizes a user-controlled file path
with `File.realpath`, then checks whether the resolved path starts
with the temp directory path. This is not a safe containment check
because sibling directories can share the same string prefix.

Severity: Medium; test-route scoped.