Advisory details:
ruby_advisory_db / gems/actionview/CVE-2016-6316
| Advisory ID | ruby_advisory_db/gems/actionview/CVE-2016-6316 |
| Aliases |
CVE-2016-6316
GHSA-pc3m-v286-2jwj |
| Summary | Possible XSS Vulnerability in Action View There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. Impact ------ Text declared as "HTML safe" when passed as an attribute value to a tag helper will not have quotes escaped which can lead to an XSS attack. Impacted code looks something like this: ```ruby content_tag(:div, "hi", title: user_input.html_safe) ``` Some helpers like the `sanitize` helper will automatically mark strings as "HTML safe", so impacted code could also look something like this: ```ruby content_tag(:div, "hi", title: sanitize(user_input)) ``` All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds ----------- You can work around this issue by either *not* marking arbitrary user input as safe, or by manually escaping quotes like this: ```ruby def escape_quotes(value) value.gsub(/"/, '"'.freeze) end content_tag(:div, "hi", title: escape_quotes(sanitize(user_input))) ``` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 6.1 |
| Reference id | Reference type | URL |
|---|---|---|
| https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no known vectors.
There are no SSVC decisions available.