Log message:
www/ruby-rails70: update to 7.0.5

7.0.5 (2023-05-24)

Changes are too many to write here, please refer
<https://github.com/rails/rails/releases/tag/v7.0.5> in detail.

Log message:
www/ruby-rails70: update to 7.0.4.3

7.0.4.3 (2023-03-13)

Active Support

* Implement SafeBuffer#bytesplice

  [CVE-2023-28120]

Action View

* Ignore certain data-* attributes in rails-ujs when element is
  contenteditable

  [CVE-2023-23913]

Log message:
www/ruby-rails70: update to 7.0.4.2

Rails 7.0.4.2 (2023-01-24)

*   Fix `domain: :all` for two letter TLD

    This fixes a compatibility issue introduced in our previous security
    release when using `domain: :all` with a two letter but single level top
    level domain domain (like `.ca`, rather than `.co.uk`).

Log message:
www/ruby-rails70: update to 7.0.4.1

Rails 7.0.4.1 (2023-01-17)

devel/ruby-activesupport70

* Avoid regex backtracking in Inflector.underscore

  [CVE-2023-22796]

www/ruby-actionpack70

* Fix sec issue with _url_host_allowed?

  Disallow certain strings from `_url_host_allowed?` to avoid a redirect
  to malicious sites.

  [CVE-2023-22797]

* Avoid regex backtracking on If-None-Match header

  [CVE-2023-22795]

* Use string#split instead of regex for domain parts

  [CVE-2023-22792]

databases/ruby-activerecord70

* Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was
  attempting sanitization. That sanitization could be bypassed with
  carefully crafted input.

  This commit makes the sanitization more robust by replacing any
  occurrances of "/*" or "*/" with "/ *" or \ 
"* /". It also performs a
  first pass to remove one surrounding comment to avoid compatibility
  issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not
  be provided user input.

  [CVE-2023-22794]

* Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type
  PostgreSQL will treat the column type as numeric. Comparing
  integer values against numeric values can result in a slow
  sequential scan.

  This behavior is configurable via
  ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Log message:
Remove lines for Ruby 2.6.

Log message:
www/ruby-actionview70: update to 7.0.4

* Guard against ActionView::Helpers::FormTagHelper#field_name calls with nil
  object_name arguments. For example:

	<%= fields do |f| %>
	  <%= f.field_name :body %>
	<% end %>

  Sean Doyle

* Strings returned from strip_tags are correctly tagged html_safe?

  Because these strings contain no HTML elements and the basic entities are
  escaped, they are safe to be included as-is as PCDATA in HTML content.
  Tagging them as html-safe avoids double-escaping entities when being
  concatenated to a SafeBuffer during rendering.

  Fixes rails/rails-html-sanitizer#124

  Mike Dalessio

Log message:
www/ruby-rails70: update to 7.0.3.1

Rails 7.0.3.1 (2022-07-12) updates databases/ruby-activerecord70 only.

databases/ruby-activerecord70

* Change ActiveRecord::Coders::YAMLColumn default to safe_load

  This adds two new configuration options The configuration options are as
  follows:

	o config.active_storage.use_yaml_unsafe_load

  When set to true, this configuration option tells Rails to use the old
  "unsafe" YAML loading strategy, maintaining the existing behavior but
  leaving the possible escalation vulnerability in place.  Setting this
  option to true is *not* recommended, but can aid in upgrading.

	o config.active_record.yaml_column_permitted_classes

  The "safe YAML" loading method does not allow all classes to be
  deserialized by default.  This option allows you to specify classes deemed
  "safe" in your application.  For example, if your application uses Symbol
  and Time in serialized data, you can add Symbol and Time to the allowed
  list as follows:

	config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]

  [CVE-2022-32224]

Log message:
www/ruby-actionview70: update to 7.0.3

7.0.3 (2022-05-12)

* Ensure models passed to form_for attempt to call to_model.

Log message:
www/ruby-actionview70: update to 7.0.2.4

## Rails 7.0.2.4 (April 26, 2022) ##

*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.

    Escape dangerous characters in names of tags and names of attributes in the
    tag helpers, following the XML specification. Rename the option
    `:escape_attributes` to `:escape`, to simplify by applying the option to the
    whole tag.

    *Álvaro Martín Fraguas*

Log message:
rails 7.0 wants ruby 2.7+, mark it as such