# \[ANN\] Rilasciata la gemma codesake-dawn v 0.80

**URL:** <https://www.ruby-forum.com/t/ann-rilasciata-la-gemma-codesake-dawn-v-0-80/238021>\
**Category:** IT\
**Created:** [December 12, 2013, 11:24am UTC](https://www.ruby-forum.com/t/ann-rilasciata-la-gemma-codesake-dawn-v-0-80/238021 "2013-12-12T11:24:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\
**Post date:** [December 12, 2013, 11:24am UTC](https://www.ruby-forum.com/t/ann-rilasciata-la-gemma-codesake-dawn-v-0-80/238021/1 "2013-12-12T11:24:42Z")

</div>

Ciao a tutti. E’ stato un inizio dell’inverno molto movimentato per la  
parte di application security ed il mondo delle web application in  
Ruby.

Il 26 Novembre [1] sono uscite due vulnerabilit: un heap based buffer  
overflow sull’interprete Ruby (CVE-2013-4164) ed un XSS sulla gemma  
omniauth-facebook (CVE-2013-4562).

Settimana scorsa[2] stato veramente movimentato il gruppo degli  
annunci di security di ruby. Ci sono stati un XSS sulla gemma  
simple\_form, un XSS su Rails a causa della gemma ruby-i18n  
(CVE-2013-4491 e CVE-2013-4492), un XSS sull’helper number\_to\_currency  
(CVE-2013-6415), un denial of service su ActionView (CVE-2013-6414),  
un XSS sull’helper simple\_format (CVE-2013-6416) ed ancora una  
vulnerabilit legata all’assegnazione massiva in ActiveRecord che ha  
dato tanti problemi ad inizio anno (CVE-2013-6417).

Questa mattina ho rilasciato la versione 0.80 del tool di code review  
per ruby codesake-dawn che implementa, tra le altre cose, i controlli  
per tutte queste vulnerabilit.  
Il codice disponibile su rubygems[3] come sempre.

Enjoy it!  
Paolo

## [1] [Ruby and omniauth-facebook gem security issues this week | The Armored Code](http://armoredcode.com/blog/ruby-and-omniauth-facebook-gem-security-issues-this-week/) [2] [Updates from the Ruby security world: 6 new vulnerabilities as X'mas gift | The Armored Code](http://armoredcode.com/blog/updates-from-the-ruby-security-world-6-new-vulnerabilities-as-xmas-gift/) [3] [codesake-dawn | RubyGems.org | your community gem host](https://rubygems.org/gems/codesake-dawn)

$ cd /pub  
$ more beer

The Application Security blog you really want to read:

> **[Home](http://armoredcode.com)**
>
> {% if page.url ==

---

<div class="post-metadata">

**Author:** ![paolo\_p](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecc23a/32.png) [@paolo\_p](https://www.ruby-forum.com/u/paolo_p)\
**Post date:** [December 12, 2013, 11:57am UTC](https://www.ruby-forum.com/t/ann-rilasciata-la-gemma-codesake-dawn-v-0-80/238021/2 "2013-12-12T11:57:26Z")

</div>

n1 🙂

2013/12/12 Paolo P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)