CVE-2020-5267 — Possible XSS vulnerability in ActionView

Affected: rails actionview

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

GHSA-65cv-r6x7-79hv — Cross site scripting vulnerability in ActionView

Affected: RubyGems: actionview

There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.

### Impact

There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:

```erb <script>let a = `<%= j unknown_input %>`</script> ```

```erb <script>let a = `<%= escape_javascript unknown_input %>`</script> ```

### Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

### Workarounds

For those that can't upgrade, the following monkey patch may be used:

```ruby ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!( { "`" => "\\`", "$" => "\\$" } )

module ActionView::Helpers::JavaScriptHelper alias :old_ej :escape_javascript alias :old_j :j

def escape_javascript(javascript) javascript = javascript.to_s if javascript.empty? result = "" else result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP) end javascript.html_safe? ? result.html_safe : result end

alias :j :escape_javascript end ```

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* [5-2-js-helper-…

Most recent entries from all

CVE-2020-5267 — Possible XSS vulnerability in ActionView

GHSA-65cv-r6x7-79hv — Cross site scripting vulnerability in ActionView