chore(deps): update dependency yard to "~> 0.9", ">= 0.9.20" [security] #91
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
"~> 0.8"->"~> 0.9", ">= 0.9.20"GitHub Vulnerability Alerts
CVE-2017-17042
lib/yard/core_ext/file.rbin the server in YARD before 0.9.11 does not block relative paths with an initial../sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.CVE-2019-1020001
Possible arbitrary path traversal and file access via
yard serverImpact
A path traversal vulnerability was discovered in YARD <= 0.9.19 when using
yard serverto serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.
Patches
Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.
Workarounds
For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via
yard server -s webrick), as can certain rules in your webserver configuration.Release Notes
lsegal/yard (yard)
v0.9.20Compare Source
yard server. This bug would allowunsanitized HTTP requests to access arbitrary files on the machine of a
yard serverhost under certain conditions. Thanks to CuongMX fromViettel Cyber Security for discovering this vulnerability.
v0.9.19Compare Source
Module#namespace_namefunction (#1229)README.md over README.x.md or README-x.md (and the like). READMEs will now
also be ordered by filename; the first README is still chosen unless
--readmeis provided.v0.9.18Compare Source
v0.9.17Compare Source
v0.9.16Compare Source
v0.9.15Compare Source
execution. Credit to Nelson Elhage [email protected] for discovering this
issue.
v0.9.14Compare Source
v0.9.13Compare Source
@!groupdirective (#1056).v0.9.12Compare Source
specified by
yard doccommand.v0.9.11Compare Source
--readmethat allowed for arbitrary file reads ondisk. Credit to ztz [email protected] for discovering this issue.
v0.9.10Compare Source
--fail-on-warningoption foryard docwhich exits with a non-zerocode if there are any warnings (#1093).
Struct.newblocks (#1099).@see (obj)reference tags would fail (#1111)yard stats(#1123).v0.9.9Compare Source
gem uninstallhooks to remove YARD documentation files. (#1083)the anchor section. (#1082)
v0.9.8Compare Source
yard serverand by plugins.%w(...)array syntax.v0.9.7Compare Source
v0.9.6Compare Source
in these versions, but support is not guaranteed. Simple bug fixes may still
be considered via pull request only. Issues without code will be automatically
closed.
of the type specification of a given tag. Also adds {YARD::Tags::TypesExplainer}
as an implementation class for the method.
Ruby syntax highlighted source code in generated HTML. Also adds the
{YARD::Parser::Ruby::TokenResolver} implementation class to iterate over
tokenized code with extra resolved object information.
A::B::C = true).LibraryVersion#yardoc_file_for_SOURCEcallback method for sources witha pre-determined yardoc file location. Implement this method instead of
manually setting
library.yardoc_file = ...in your load method (you canstill assign the attribute manually).
v0.9.5Compare Source
yard docwill now generate.yardoc/processingand.yardoc/completefilesto allow other tools to properly detect when YARD is in the middle of parsing
source files, and when it has completed writing the database.
:disksource type. LibraryVersion objects pointing to a .yardoc databasedirectory will now auto-generate if there is a
source_pathattached.v0.9.4Compare Source
v0.9.3Compare Source
yard server --forkv0.9.2Compare Source
v0.9.1Compare Source
Module#namespace_namefunction (#1229)README.md over README.x.md or README-x.md (and the like). READMEs will now
also be ordered by filename; the first README is still chosen unless
--readmeis provided.v0.9.0Compare Source
Special thanks to Alex Dowad, MSP-Greg, and Alex McLain for their extended
contributions to this version.
This change may affect backward compatibility if custom templates made modifications
to
default/fulldoc/html, specifically the index or navigation lists.supports:
private def foo(x, y) end
in HTML comment blocks (
<!--\n @​metadata here... \n-->). Ensure that the openingcomment tag is alone on the first line of the file to use this functionality.
yard server.v0.8.7.6Compare Source
@optiontag on keyword arg splat parameter. (#729).stats_optionsforYardocTask. (#800, #801)v0.8.7.5Compare Source
are preceded by code. (#798)
@overloadtags. (#794)yard statsfor objects with no file property. (#792)Markdown standard.
private_class_methodsupport. (#760, #767)v0.8.7.4Compare Source
private_class_method(#747)v0.8.7.3Compare Source
v0.8.7.2Compare Source
v0.8.7.1Compare Source
v0.8.7Compare Source
@optiontag on keyword arg splat parameter. (#729).stats_optionsforYardocTask. (#800, #801)v0.8.6.2Compare Source
yard graphwas not displaying methodsv0.8.6.1Compare Source
yard displayto wrap output in layout template.v0.8.6Compare Source
yard graphwas not displaying methodsv0.8.5.2Compare Source
v0.8.5.1Compare Source
yard diffof gem files with RubyGems 2.xv0.8.5Compare Source
v0.8.4.1Compare Source
v0.8.4Compare Source
v0.8.3Compare Source
--non-transitive-tagto disable tag transitivity (#571){include:Object#method}syntax (#569)--apiand--no-apisupport (#559)v0.8.2.1Compare Source
v0.8.2Compare Source
v0.8.1Compare Source
--[no-]apiswitch to generate docs for API sets (see {file:docs/WhatsNew.md} for details) (#532)yard listcommand now uses cache by default (#533)yardocgenerating incorrectly named method list file (#528)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - "before 4am on Monday" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.