GHSA-xq5j-gw7f-jgj8 CSRF Vulnerability in rails-ujs

• RubyGems actionview: >= 5.0.0, < 5.2.4.3 → fixed in 5.2.4.3 • RubyGems actionview: >= 6.0.0, < 6.0.3.1 → fixed in 6.0.3.1

There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains. Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1 Impact ------ This is a regression of CVE-2015-1840. In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent. Workarounds ----------- To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters. For example, code like this: link_to params to code like this: link_to filtered_params def filtered_params # Filter just the parameters that you trust end