{"action":"opened","number":234,"pull_request":{"url":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234","id":232261662,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMyMjYxNjYy","html_url":"https://github.com/moneyadviceservice/publify/pull/234","diff_url":"https://github.com/moneyadviceservice/publify/pull/234.diff","patch_url":"https://github.com/moneyadviceservice/publify/pull/234.patch","issue_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/234","number":234,"state":"open","locked":false,"title":"[9316] Bump gems with security vulnerabilities, fix assets issue","user":{"login":"your","id":9043263,"node_id":"MDQ6VXNlcjkwNDMyNjM=","avatar_url":"https://avatars1.githubusercontent.com/u/9043263?v=4","gravatar_id":"","url":"https://api.github.com/users/your","html_url":"https://github.com/your","followers_url":"https://api.github.com/users/your/followers","following_url":"https://api.github.com/users/your/following{/other_user}","gists_url":"https://api.github.com/users/your/gists{/gist_id}","starred_url":"https://api.github.com/users/your/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/your/subscriptions","organizations_url":"https://api.github.com/users/your/orgs","repos_url":"https://api.github.com/users/your/repos","events_url":"https://api.github.com/users/your/events{/privacy}","received_events_url":"https://api.github.com/users/your/received_events","type":"User","site_admin":false},"body":"[TP 9316](https://moneyadviceservice.tpondemand.com/entity/9316-upgrade-sprockets-and-rails-html-sanitizer)\r\n\r\nThis PR is bumping gems to address a few vulnerabilities.\r\nAdditionally, it fixes a problem with precompiled assets.\r\n\r\nMore information in the sections below, please read.\r\n\r\n## Security vulnerabilities\r\n\r\nBased on work done in https://github.com/moneyadviceservice/publify/pull/229.\r\n\r\n#### CVE-2018-3760 [High severity]\r\n\r\nSpecially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory\r\n\r\n#### CVE-2018-3741 [Moderate severity]\r\n\r\nThere is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4.\r\n\r\n#### CVE-2018-16468 [Moderate severity]\r\n\r\nIn the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.\r\n\r\n## Precompiled assets issue\r\n\r\nWhether or not this problem has been introduced with the sprockets bump, it's is still a bit of a mystery, but what happened most likely is that a few assets are now being compiled in a slightly different way to the previous one, so that the file fingerprint (digest) has changed, and possibly helped spotting an existing configuration issue.\r\n\r\n### History:\r\n\r\n* https://github.com/moneyadviceservice/publify/pull/182 – App mounted under `/blog`, `asset_host` set to `AZURE_ASSETS_STORAGE_BLOG_URL`\r\n* https://github.com/moneyadviceservice/scripts/pull/586 – Assets upload functionality extended to blog\r\n* https://github.com/moneyadviceservice/scripts/commit/dd9a249e42a86d67891ca171e8f54bf3781db37e – Azure ENVs made dependent on the env (1 container for each environment), `AZURE_ASSETS_STORAGE_BLOG_URL` kept as a host without the container in the URL\r\n\r\n### Explanation of the problem\r\n**As a consequence, application assets are being currently pulled always from the `/blog` container**, since the way Rails works is by concatenating the `config.action_controller.asset_host` with `config.relative_url_root` and the `config.assets.prefix` (`/assets` by default), and there is no container information in this chain. With the current setup only the `carrierwave` gem is environment-dependent.\r\n\r\nYou can easily check the above by looking at https://www.uat.dev.mas.local/blog/.\r\n\r\n### Possible Solution\r\n\r\nPrepend the `config.relative_url_root` to `config.assets.prefix` and make sure that the `config.action_controller.asset_host` appends the path to the container for the environment.\r\n\r\nThis way assets will always be uploaded and fetched to/from:\r\n\r\n`{asset_host}/{asset_container}/{relative_url_root}/assets`.","created_at":"2018-11-20T10:20:27Z","updated_at":"2018-11-20T10:20:27Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234/commits","review_comments_url":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234/comments","review_comment_url":"https://api.github.com/repos/moneyadviceservice/publify/pulls/comments{/number}","comments_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/234/comments","statuses_url":"https://api.github.com/repos/moneyadviceservice/publify/statuses/f725b1e2c824121ec7b28753f21e79e3a4445cfc","head":{"label":"moneyadviceservice:9316_bump-gems-security-vulnerabilities","ref":"9316_bump-gems-security-vulnerabilities","sha":"f725b1e2c824121ec7b28753f21e79e3a4445cfc","user":{"login":"moneyadviceservice","id":2064781,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIwNjQ3ODE=","avatar_url":"https://avatars1.githubusercontent.com/u/2064781?v=4","gravatar_id":"","url":"https://api.github.com/users/moneyadviceservice","html_url":"https://github.com/moneyadviceservice","followers_url":"https://api.github.com/users/moneyadviceservice/followers","following_url":"https://api.github.com/users/moneyadviceservice/following{/other_user}","gists_url":"https://api.github.com/users/moneyadviceservice/gists{/gist_id}","starred_url":"https://api.github.com/users/moneyadviceservice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moneyadviceservice/subscriptions","organizations_url":"https://api.github.com/users/moneyadviceservice/orgs","repos_url":"https://api.github.com/users/moneyadviceservice/repos","events_url":"https://api.github.com/users/moneyadviceservice/events{/privacy}","received_events_url":"https://api.github.com/users/moneyadviceservice/received_events","type":"Organization","site_admin":false},"repo":{"id":25460305,"node_id":"MDEwOlJlcG9zaXRvcnkyNTQ2MDMwNQ==","name":"publify","full_name":"moneyadviceservice/publify","private":false,"owner":{"login":"moneyadviceservice","id":2064781,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIwNjQ3ODE=","avatar_url":"https://avatars1.githubusercontent.com/u/2064781?v=4","gravatar_id":"","url":"https://api.github.com/users/moneyadviceservice","html_url":"https://github.com/moneyadviceservice","followers_url":"https://api.github.com/users/moneyadviceservice/followers","following_url":"https://api.github.com/users/moneyadviceservice/following{/other_user}","gists_url":"https://api.github.com/users/moneyadviceservice/gists{/gist_id}","starred_url":"https://api.github.com/users/moneyadviceservice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moneyadviceservice/subscriptions","organizations_url":"https://api.github.com/users/moneyadviceservice/orgs","repos_url":"https://api.github.com/users/moneyadviceservice/repos","events_url":"https://api.github.com/users/moneyadviceservice/events{/privacy}","received_events_url":"https://api.github.com/users/moneyadviceservice/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/moneyadviceservice/publify","description":"Money Advice Service's Marketing Blog","fork":false,"url":"https://api.github.com/repos/moneyadviceservice/publify","forks_url":"https://api.github.com/repos/moneyadviceservice/publify/forks","keys_url":"https://api.github.com/repos/moneyadviceservice/publify/keys{/key_id}","collaborators_url":"https://api.github.com/repos/moneyadviceservice/publify/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/moneyadviceservice/publify/teams","hooks_url":"https://api.github.com/repos/moneyadviceservice/publify/hooks","issue_events_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/events{/number}","events_url":"https://api.github.com/repos/moneyadviceservice/publify/events","assignees_url":"https://api.github.com/repos/moneyadviceservice/publify/assignees{/user}","branches_url":"https://api.github.com/repos/moneyadviceservice/publify/branches{/branch}","tags_url":"https://api.github.com/repos/moneyadviceservice/publify/tags","blobs_url":"https://api.github.com/repos/moneyadviceservice/publify/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/moneyadviceservice/publify/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/moneyadviceservice/publify/git/refs{/sha}","trees_url":"https://api.github.com/repos/moneyadviceservice/publify/git/trees{/sha}","statuses_url":"https://api.github.com/repos/moneyadviceservice/publify/statuses/{sha}","languages_url":"https://api.github.com/repos/moneyadviceservice/publify/languages","stargazers_url":"https://api.github.com/repos/moneyadviceservice/publify/stargazers","contributors_url":"https://api.github.com/repos/moneyadviceservice/publify/contributors","subscribers_url":"https://api.github.com/repos/moneyadviceservice/publify/subscribers","subscription_url":"https://api.github.com/repos/moneyadviceservice/publify/subscription","commits_url":"https://api.github.com/repos/moneyadviceservice/publify/commits{/sha}","git_commits_url":"https://api.github.com/repos/moneyadviceservice/publify/git/commits{/sha}","comments_url":"https://api.github.com/repos/moneyadviceservice/publify/comments{/number}","issue_comment_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/comments{/number}","contents_url":"https://api.github.com/repos/moneyadviceservice/publify/contents/{+path}","compare_url":"https://api.github.com/repos/moneyadviceservice/publify/compare/{base}...{head}","merges_url":"https://api.github.com/repos/moneyadviceservice/publify/merges","archive_url":"https://api.github.com/repos/moneyadviceservice/publify/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/moneyadviceservice/publify/downloads","issues_url":"https://api.github.com/repos/moneyadviceservice/publify/issues{/number}","pulls_url":"https://api.github.com/repos/moneyadviceservice/publify/pulls{/number}","milestones_url":"https://api.github.com/repos/moneyadviceservice/publify/milestones{/number}","notifications_url":"https://api.github.com/repos/moneyadviceservice/publify/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/moneyadviceservice/publify/labels{/name}","releases_url":"https://api.github.com/repos/moneyadviceservice/publify/releases{/id}","deployments_url":"https://api.github.com/repos/moneyadviceservice/publify/deployments","created_at":"2014-10-20T09:51:47Z","updated_at":"2018-08-15T13:20:23Z","pushed_at":"2018-11-20T10:20:28Z","git_url":"git://github.com/moneyadviceservice/publify.git","ssh_url":"git@github.com:moneyadviceservice/publify.git","clone_url":"https://github.com/moneyadviceservice/publify.git","svn_url":"https://github.com/moneyadviceservice/publify","homepage":"","size":47372,"stargazers_count":1,"watchers_count":1,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":2,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":1,"open_issues":2,"watchers":1,"default_branch":"master"}},"base":{"label":"moneyadviceservice:master","ref":"master","sha":"3e68c4b5c88f626e565ddfa27beb9658da9a16d1","user":{"login":"moneyadviceservice","id":2064781,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIwNjQ3ODE=","avatar_url":"https://avatars1.githubusercontent.com/u/2064781?v=4","gravatar_id":"","url":"https://api.github.com/users/moneyadviceservice","html_url":"https://github.com/moneyadviceservice","followers_url":"https://api.github.com/users/moneyadviceservice/followers","following_url":"https://api.github.com/users/moneyadviceservice/following{/other_user}","gists_url":"https://api.github.com/users/moneyadviceservice/gists{/gist_id}","starred_url":"https://api.github.com/users/moneyadviceservice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moneyadviceservice/subscriptions","organizations_url":"https://api.github.com/users/moneyadviceservice/orgs","repos_url":"https://api.github.com/users/moneyadviceservice/repos","events_url":"https://api.github.com/users/moneyadviceservice/events{/privacy}","received_events_url":"https://api.github.com/users/moneyadviceservice/received_events","type":"Organization","site_admin":false},"repo":{"id":25460305,"node_id":"MDEwOlJlcG9zaXRvcnkyNTQ2MDMwNQ==","name":"publify","full_name":"moneyadviceservice/publify","private":false,"owner":{"login":"moneyadviceservice","id":2064781,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIwNjQ3ODE=","avatar_url":"https://avatars1.githubusercontent.com/u/2064781?v=4","gravatar_id":"","url":"https://api.github.com/users/moneyadviceservice","html_url":"https://github.com/moneyadviceservice","followers_url":"https://api.github.com/users/moneyadviceservice/followers","following_url":"https://api.github.com/users/moneyadviceservice/following{/other_user}","gists_url":"https://api.github.com/users/moneyadviceservice/gists{/gist_id}","starred_url":"https://api.github.com/users/moneyadviceservice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moneyadviceservice/subscriptions","organizations_url":"https://api.github.com/users/moneyadviceservice/orgs","repos_url":"https://api.github.com/users/moneyadviceservice/repos","events_url":"https://api.github.com/users/moneyadviceservice/events{/privacy}","received_events_url":"https://api.github.com/users/moneyadviceservice/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/moneyadviceservice/publify","description":"Money Advice Service's Marketing Blog","fork":false,"url":"https://api.github.com/repos/moneyadviceservice/publify","forks_url":"https://api.github.com/repos/moneyadviceservice/publify/forks","keys_url":"https://api.github.com/repos/moneyadviceservice/publify/keys{/key_id}","collaborators_url":"https://api.github.com/repos/moneyadviceservice/publify/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/moneyadviceservice/publify/teams","hooks_url":"https://api.github.com/repos/moneyadviceservice/publify/hooks","issue_events_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/events{/number}","events_url":"https://api.github.com/repos/moneyadviceservice/publify/events","assignees_url":"https://api.github.com/repos/moneyadviceservice/publify/assignees{/user}","branches_url":"https://api.github.com/repos/moneyadviceservice/publify/branches{/branch}","tags_url":"https://api.github.com/repos/moneyadviceservice/publify/tags","blobs_url":"https://api.github.com/repos/moneyadviceservice/publify/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/moneyadviceservice/publify/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/moneyadviceservice/publify/git/refs{/sha}","trees_url":"https://api.github.com/repos/moneyadviceservice/publify/git/trees{/sha}","statuses_url":"https://api.github.com/repos/moneyadviceservice/publify/statuses/{sha}","languages_url":"https://api.github.com/repos/moneyadviceservice/publify/languages","stargazers_url":"https://api.github.com/repos/moneyadviceservice/publify/stargazers","contributors_url":"https://api.github.com/repos/moneyadviceservice/publify/contributors","subscribers_url":"https://api.github.com/repos/moneyadviceservice/publify/subscribers","subscription_url":"https://api.github.com/repos/moneyadviceservice/publify/subscription","commits_url":"https://api.github.com/repos/moneyadviceservice/publify/commits{/sha}","git_commits_url":"https://api.github.com/repos/moneyadviceservice/publify/git/commits{/sha}","comments_url":"https://api.github.com/repos/moneyadviceservice/publify/comments{/number}","issue_comment_url":"https://api.github.com/repos/moneyadviceservice/publify/issues/comments{/number}","contents_url":"https://api.github.com/repos/moneyadviceservice/publify/contents/{+path}","compare_url":"https://api.github.com/repos/moneyadviceservice/publify/compare/{base}...{head}","merges_url":"https://api.github.com/repos/moneyadviceservice/publify/merges","archive_url":"https://api.github.com/repos/moneyadviceservice/publify/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/moneyadviceservice/publify/downloads","issues_url":"https://api.github.com/repos/moneyadviceservice/publify/issues{/number}","pulls_url":"https://api.github.com/repos/moneyadviceservice/publify/pulls{/number}","milestones_url":"https://api.github.com/repos/moneyadviceservice/publify/milestones{/number}","notifications_url":"https://api.github.com/repos/moneyadviceservice/publify/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/moneyadviceservice/publify/labels{/name}","releases_url":"https://api.github.com/repos/moneyadviceservice/publify/releases{/id}","deployments_url":"https://api.github.com/repos/moneyadviceservice/publify/deployments","created_at":"2014-10-20T09:51:47Z","updated_at":"2018-08-15T13:20:23Z","pushed_at":"2018-11-20T10:20:28Z","git_url":"git://github.com/moneyadviceservice/publify.git","ssh_url":"git@github.com:moneyadviceservice/publify.git","clone_url":"https://github.com/moneyadviceservice/publify.git","svn_url":"https://github.com/moneyadviceservice/publify","homepage":"","size":47372,"stargazers_count":1,"watchers_count":1,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":2,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":1,"open_issues":2,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234"},"html":{"href":"https://github.com/moneyadviceservice/publify/pull/234"},"issue":{"href":"https://api.github.com/repos/moneyadviceservice/publify/issues/234"},"comments":{"href":"https://api.github.com/repos/moneyadviceservice/publify/issues/234/comments"},"review_comments":{"href":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234/comments"},"review_comment":{"href":"https://api.github.com/repos/moneyadviceservice/publify/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/moneyadviceservice/publify/pulls/234/commits"},"statuses":{"href":"https://api.github.com/repos/moneyadviceservice/publify/statuses/f725b1e2c824121ec7b28753f21e79e3a4445cfc"}},"author_association":"MEMBER","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":5,"additions":88,"deletions":76,"changed_files":18}}
{"actor":{"display_login":"your"}}