Defect #37719: Broken serialized columns, if saved time was with Rails 4.2 - Redmine

Actions

Copy link

Defect #37719

closed

Broken serialized columns, if saved time was with Rails 4.2

Added by Alexander Meindl over 1 year ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Go MAEDA

Category:

Plugin API

Target version:

Start date:

Due date:

% Done:

Estimated time:

Resolution:

Affected version:

Description

Broken serialized columns, if saved time was with Rails 4.2

All serialized columns are broken, if the data in database was saved with Rails 4.2 in older redmine versions.

This bug was introducted with #37452 and CVE-2022-32224

E.g. saved settings for all plugins are broken, if the last save was with Rails 4.2:

Psych::DisallowedClass (Tried to load unspecified class: ActionController::Parameters):

app/models/setting.rb:111:in `value'
app/models/setting.rb:125:in `[]'
app/models/setting.rb:320:in `plugin_redmine_issue_templates'
app/controllers/settings_controller.rb:78:in `plugin'
lib/redmine/sudo_mode.rb:61:in `sudo_mode'

The easiest solution for this would be, to add "ActionController::Parameters" to config.active_record.yaml_column_permitted_classes
Maybe there is an other solution to convert ActionController::Parameters to ActiveSupport::HashWithIndifferentAccess for existing stored data, but I did not found one.

I think it is important to solve this bug before releasing 5.0.3, because lots of Redmine systems are affected by this problem.

My environment:

Redmine Master (same bug with upcoming 5.0.3)
PostgreSQL 14
Ruby 3.1.2 (same problem with older ruby versions)

Files

yaml_column_permitted_classes.patch (527 Bytes) yaml_column_permitted_classes.patch

Alexander Meindl, 2022-09-28 05:15

Related issues

Actions

Copy link

Updated by Go MAEDA over 1 year ago

Could you tell me the version of Redmine and Issue Templates Plugin?

I tried to reproduce the issue by migrating the database from the following environment to the current trunk but I could not.

Source environment: Redmine 3.4.13 (Rails 4.2.11.1), Redmine Issue Templates Plugin 0.2.1

Actions

Copy link

Updated by Alexander Meindl over 1 year ago

Hi,

Did you press "Save" on plugin settings of Issue Templates Plugin?

With "Save" rails stores "ActionController::Parameters" in database (serialize). "Issue Templates Plugin" is only an example, this happens with all serialized columns, which stored data in database with Rails < 5.

I get this error with all plugins, this was just an example. If you update settings with Redmine 5.0.2, data in database uses ActiveSupport::HashWithIndifferentAccess and the problem would be fixed. But with current master, older serialized data with "ActionController::Parameters" could not read anymore because of Psych::DisallowedClass after updating to latest Redmine version.

PS: after update to latest Redmine I use the latest Issue Templates Plugin. I do not remember, which version was active on old redmine version - but I think it doesn't matter, problem exists with all versions.

Actions

Copy link