GHSA-vfm5-rmrh-j26v
GitHub Security Advisory
Possible Content Security Policy bypass in Action Dispatch
Advisory Details
There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack.
Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
--------
The fixed releases are available at the normal locations.
Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
Affected Packages
Related CVEs
Key Information
Dataset
Data from GitHub Advisory Database. This information is provided for research and educational purposes.