| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 5.0.3 source code.tar.gz | 2026-10-25 | 835.7 kB | |
| 5.0.3 source code.zip | 2026-10-25 | 896.0 kB | |
| README.md | 2026-10-25 | 565 Bytes | |
| Totals: 3 Items | 1.7 MB | 0 | |
Security release.
Fixes a reflected XSS and open redirect in sort_link and sort_url. Request
parameters were passed to url_for, so a crafted query string such as
?script_name=javascript:... could make every sort link on a page run script in
the application's origin or point to another site when clicked. Ransack now drops
url_for's URL options (script_name, host, protocol, only_path and others)
from the request params it carries into the link. Affects any page that renders a
sort link.
GHSA-58rx-96gf-w92x. Also released as 6.0.1 and 4.4.4.
