rails: Rails 4.2.11.2: uninitialized constant Module::DELEGATION_RESERVED_METHOD_NAMES
Steps to reproduce
- Upgraded an existing rails app from 4.2.11.1 to 4.2.11.2.
- Started a local dev server and tried to access
localhost:3000
- Receive 500 Internal Server Error
Logs show:
ActionView::Template::Error (uninitialized constant Module::DELEGATION_RESERVED_METHOD_NAMES):
/Users/bob/bubaflub/truelink/app/controllers/application_controller.rb:597:in `redacted'
/Users/bob/bubaflub/truelink/lib/redacted_middleware.rb:13:in `redacted'
Expected behavior
Shouldn’t break an existing app.
Actual behavior
Breaks an existing app.
System configuration
Rails version: 4.2.11.2
Ruby version: 2.4.10 via rvm
on Mac OS X 10.15.3
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Reactions: 2
- Comments: 25 (5 by maintainers)
Links to this issue
Commits related to this issue
- Restrict which local names can be eval'd [CVE-2020-8163] — committed to rails/rails by matthewd 4 years ago
- CVE-2020-8163: regression fix Allow again the following non-reserved local names: _ arg args block Closes: #39301 — committed to Beuc/rails by Beuc 4 years ago
I am very sorry. I will make a release again.
I shipped 4.2.11.3 with #39302. Thanks for reporting this as well as the PR to fix it.
Thanks, @tenderlove!
Please note that Rails 4.2 is not supported. We are trying to do a favor to people still using that unsupported version by releasing a new version instead of just sending an advisory with a patch. The Rails 4.2 build is not passing anymore given the Ruby versions supported today are different of the versions supported on that series, so we can’t expect the build will pass when we make a security release. That is how this passed through review and automated testing to make in to an unsupported official release.
I have a PR up for this in #39302.
I’m curious to know how this passed through review and automated testing to make it to an official release.
This commit https://github.com/rails/rails/commit/4c46a15e0a7815ca9e4cd7c7fda042eb8c1b7724 broke redmine 3.4 (/my/page):
production.log:
After manual revert this patch error gone.
Thank you for the offer but Rails 4.2 is not supported anymore and even just reviewing changes to the test suite would still require time and energy from the core team on a version that is not supported.