Sourced from redis-store's releases.

Replace marshalling with serialization

Due to concerns over a possible vulnerability (should someone obtain write access to the Redis database the application is using) related to marshalling in #289 , we've replaced the Marshalling feature with Serialization, allowing the user to specify their own serializer responding to the .dump and .load methods. This is similar to how Dalli works.

Using an alternative serializer like YAML or JSON means if your Redis server becomes compromised in any way, the compromise cannot affect your running app. However, not all objects serialize cleanly to YAML and/or JSON. In order to achieve backwards compatibility, we have supplied Marshal as the default serializer object, and released a minor version of this gem. All recent versions of redis-store gems (like redis-activesupport and redis-actionpack) that depend on this gem allow for redis-store up to but not including 2.0.0, so to get this version you can run:

bundle update redis-store

A CVE has been filed, CVE-2017-1000248, so that this issue is easier to refer to.

Improvements to marshalling

This is a minor release due to an additional marshalling feature,
support for marshalling on the mset method. Some bug fixes also
surrounding marshalling have also been included.

• Forward new Hash, not nil, when options are unset John Guidry
• Enable cache and move to containerized build. Omer Katz
• Add support for marshalling mset John Guidry
• Set :raw => true if marshalling Tom Scott

Shoutouts to @​tvjg and @​thedrow who contributed (most of) the code for this release!

Sourced from redis-store's changelog.

1.4.0

Breaking Changes

• None

Added

• Pluggable backend for serializing data in/out of Redis, eventually replacing :marshalling in v2.

Fixed

• Conventional Marshal.dump usage allowing potential security vulnerability (CVE-2017-1000248)

1.3.0

Breaking Changes

• None

Added

• Add support for marshalling mset

Fixed

• Set :raw => true if marshalling
• Forward new Hash, not nil, when options are unset

1.2.0

Breaking Changes

• None

Added

• Allow changing namespaces on the fly
• Begin testing against ruby 2.3.0

Fixed

• Use batched deletes for flushdb with a namespace
• pass set command options to redis
• bump rbx 2
• fix setex marshalling for distributed store
• changes to new url
• ⚠️ shadowing outer local variable - key, pattern, value
• ⚠️ `*' interpreted as argument prefix
• Removed duplicated method ttl

... (truncated)

• 26c20ec v1.4.0: Replace marshalling with serialization
• 7e3470b Add semver compliance to README
• ce13252 Merge pull request #290 from redis-store/replace-marshalling-with-serialization
• e0c1398 Replace marshalling with pluggable serializers
• 589d2d0 Merge pull request #286 from yovasx2/allow-special-characters-in-passwords
• 33b02b8 Add escape function for passwords
• 8c103d0 Add pry for development debug
• 5c8d967 Update must_equal syntax to must_be_nil for Minitest, and fix redis-store con...
• 59191bc Remove stdout file from dir and rbx from build
• 06078ee Merge pull request #275 from jaredbeck/update_changelog
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.