GHSA-vfm5-rmrh-j26v Possible Content Security Policy bypass in Action Dispatch

• RubyGems actionpack: >= 5.2.0, < 7.0.8.7 → fixed in 7.0.8.7 • RubyGems actionpack: >= 7.1.0, < 7.1.5.1 → fixed in 7.1.5.1 • RubyGems actionpack: >= 7.2.0, < 7.2.2.1 → fixed in 7.2.2.1 • RubyGems actionpack: >= 8.0.0, < 8.0.0.1 → fixed in 8.0.0.1

There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack. Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. Credits ------- Thanks to ryotak for the report!