GHSA-mm2p-6q2v-7ph5: 
Ruby vulnerability analysis and mitigation

Impact

MetaInspector modified the faraday_options hash passed to MetaInspector.new: it added :url and deleted :redirect. When an application reuses the same hash for several requests (for example, a constant), the redirect options are gone after the first request. Since 5.15.0, faraday_options[:redirect] is the documented way to pass a callback to Faraday's FollowRedirects middleware, for example to block redirects to private IP addresses and prevent server-side request forgery (SSRF). With a reused hash, that callback only runs on the first request. Later requests follow redirects to any host, up to the default limit of 10. You are affected if you pass a redirect callback (or other redirect options) through faraday_options and reuse the same hash object across calls. Building a new hash for every call is not affected. A frozen faraday_options hash raised FrozenError on every request, and the top-level faraday_http_cache hash got a :serializer key added. Neither has a security impact.

Patches

Fixed in 5.19.0: MetaInspector now works on copies and leaves the hashes it is given unchanged.

Workarounds

Pass a new hash on every call instead of reusing one, for example faraday_options: { redirect: { callback: BLOCK_PRIVATE_IPS } } built inline, or faraday_options: FARADAY_OPTIONS.merge(redirect: REDIRECT_OPTIONS.dup).

References

• Redirect options added in https://github.com/jaimeiniesta/metainspector/pull/355 (5.15.0)