Subject: CVS commit: pkgsrc/www/ruby-actionpack3
From: Takahiro Kambe
Date: 2012-08-12 11:46:45
Message id: 20120812094645.3302A175DD@cvs.netbsd.org

Log Message:
Update ruby-actionpack3 to 3.0.17

## Rails 3.0.17 (Aug 9, 2012)

* There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
  helper doesn't correctly handle malformed html.  As a result an attacker can
  execute arbitrary javascript through the use of specially crafted malformed
  html.

  *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*

* When a "prompt" value is supplied to the `select_tag` helper, the \ 
"prompt"
  value is not escaped.  If untrusted data is not escaped, and is supplied as
  the prompt value, there is a potential for XSS attacks.
  Vulnerable code will look something like this:
    select_tag("name", options, :prompt => UNTRUSTED_INPUT)

  *Santiago Pastorino*

Files:
RevisionActionfile
1.16modifypkgsrc/www/ruby-actionpack3/distinfo