From 691ea1aac37ab6268e1b46394c1788161709f5d5 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 13 Feb 2021 17:55:53 +0800 Subject: [PATCH 01/11] fix html_safe method 1 --- app/helpers/users_helper.rb | 3 +-- app/views/events/show.html.erb | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index ed49051..e2c921e 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -7,9 +7,8 @@ def user_avatar_link(user) email_md5 = Digest::MD5.hexdigest(user.email) gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}" - str = "
" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
" + "
".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
".html_safe - str.html_safe end end diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 0e89067..14feb24 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -22,7 +22,7 @@
- <%= raw comment.content %> + <%= sanitize comment.content %>
@@ -50,4 +50,4 @@
<%= f.submit "Comment", :class => "btn btn-primary" %>
-<% end %> \ No newline at end of file +<% end %> From befdb2b07872246c9e85d01593ac693ee7ea8fc0 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 13 Feb 2021 18:00:08 +0800 Subject: [PATCH 02/11] fix html_safe method 2 --- app/helpers/users_helper.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index e2c921e..ed6fd1e 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -7,7 +7,9 @@ def user_avatar_link(user) email_md5 = Digest::MD5.hexdigest(user.email) gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}" - "
".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
".html_safe + content_tag(:div, + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name , + :class => "user_link" ) end From 9a368818722beee7cf766e24eb214f443a8c1f43 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 17 Apr 2021 12:57:28 +0800 Subject: [PATCH 03/11] how to deal with CSRF --- app/controllers/application_controller.rb | 2 +- app/views/events/show.html.erb | 2 +- config/routes.rb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 682a07d..cd6ea53 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,6 @@ class ApplicationController < ActionController::Base - # protect_from_forgery with: :exception + protect_from_forgery with: :exception helper_method :current_cart diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 14feb24..2996fec 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -29,7 +29,7 @@ <%= comment.created_at.to_s %> <% if current_user && current_user.is_admin? %> - <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %> + <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post, :class => "btn btn-default" %> <% end %> <% if comment.can_deleted_by(current_user) %> diff --git a/config/routes.rb b/config/routes.rb index 2cfd938..a5ccf3e 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -7,7 +7,7 @@ resources :events do resources :comments do member do - get :highlight + post :highlight end end end From d7369edf617772ceee92e97ff5f907e5523a1329 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Mon, 19 Apr 2021 12:21:27 +0800 Subject: [PATCH 04/11] SQL injection --- app/controllers/events_controller.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index 245dece..212fbe1 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -9,7 +9,8 @@ def show @comments = @event.comments if params[:keyword] - @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'") + keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] ) + @comments = @comments.where( "comments.content LIKE '%#{keyword}%'" ) end if params[:sort] From 39316198dec3526f229a4506dc51753c5fb7754d Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Mon, 19 Apr 2021 12:29:22 +0800 Subject: [PATCH 05/11] =?UTF-8?q?more=20exact=20=E9=80=B8=E5=87=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/controllers/events_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index 212fbe1..1f03bc9 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -10,7 +10,7 @@ def show if params[:keyword] keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] ) - @comments = @comments.where( "comments.content LIKE '%#{keyword}%'" ) + @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%" ) end if params[:sort] From 5d9a48eba86b04c07f0f2c517d6a0123231ce0ec Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Wed, 21 Apr 2021 23:59:36 +0800 Subject: [PATCH 06/11] try to use sanitize --- app/controllers/events_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index 1f03bc9..2d162b6 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -13,7 +13,7 @@ def show @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%" ) end - if params[:sort] + if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort]) # 只有白名单内的参数可以用 @comments = @comments.order(params[:sort]) end From 5b634ca7c93ec17e74fb2555484160594de389e3 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Thu, 22 Apr 2021 18:17:26 +0800 Subject: [PATCH 07/11] fix user permit params --- app/controllers/users_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index f1d232d..fd6cac4 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -21,7 +21,7 @@ def update protected def user_params - params.require(:user).permit(:nickname, :role) + params.require(:user).permit(:nickname) end end From c87ba19afc4746c41de8d427998e610df306249d Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 1 May 2021 16:30:34 +0800 Subject: [PATCH 08/11] bundle rack-attack --- Gemfile | 2 ++ Gemfile.lock | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index e91c3ae..ec1e696 100644 --- a/Gemfile +++ b/Gemfile @@ -40,6 +40,8 @@ gem 'jbuilder', '~> 2.5' # Use Capistrano for deployment # gem 'capistrano-rails', group: :development +gem 'rack-attack' + group :development, :test do gem 'rspec-rails' # Call 'byebug' anywhere in the code to stop execution and get a debugger console diff --git a/Gemfile.lock b/Gemfile.lock index 30c443b..90919e1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -98,6 +98,8 @@ GEM orm_adapter (0.5.0) puma (3.8.2) rack (2.0.1) + rack-attack (6.5.0) + rack (>= 1.0, < 3) rack-test (0.6.3) rack (>= 1.0) rails (5.0.2) @@ -200,6 +202,7 @@ DEPENDENCIES jquery-rails listen (~> 3.0.5) puma (~> 3.0) + rack-attack rails (~> 5.0.2) rspec-rails sass-rails (~> 5.0) @@ -212,4 +215,4 @@ DEPENDENCIES web-console (>= 3.3.0) BUNDLED WITH - 1.14.6 + 1.17.3 From 7e64780b69ebdaadba4e0db36839078cb8afddbb Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 1 May 2021 17:17:07 +0800 Subject: [PATCH 09/11] rack-attack --- config/application.rb | 3 +- config/initializers/rack-attack.rb | 59 ++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 1 deletion(-) create mode 100644 config/initializers/rack-attack.rb diff --git a/config/application.rb b/config/application.rb index 2d9ee51..a8be62d 100644 --- a/config/application.rb +++ b/config/application.rb @@ -12,8 +12,9 @@ class Application < Rails::Application # Application configuration should go into files in config/initializers # -- all .rb files in that directory are automatically loaded. config.time_zone = "Beijing" + config.middleware.use Rack::Attack end end -Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') \ No newline at end of file +Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') diff --git a/config/initializers/rack-attack.rb b/config/initializers/rack-attack.rb new file mode 100644 index 0000000..61a40b9 --- /dev/null +++ b/config/initializers/rack-attack.rb @@ -0,0 +1,59 @@ +class Rack::Attack + + throttle('req/ip', :limit => 180, :period => 1.minutes) do |req| + req.ip + end + + ### Prevent Brute-Force Login Attacks ### + + + # The most common brute-force login attack is a brute-force password + + # attack where an attacker simply tries a large number of emails and + + # passwords to see if any credentials match. + + # + + # Another common method of attack is to use a swarm of computers with + + # different IPs to try brute-forcing a password for a specific account. + + + # Throttle POST requests to /login by IP address + + # + + # Key: "rack::attack:#{Time.now.to_i/:period}:logins/ip:#{req.ip}" + + throttle('logins/ip', :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + req.ip + end + end + + # Throttle POST requests to /login by email param + + # + + # Key: "rack::attack:#{Time.now.to_i/:period}:logins/email:#{req.email}" + + # + + # Note: This creates a problem where a malicious user could intentionally + + # throttle logins for another user and force their login requests to be + + # denied, but that's not very common and shouldn't happen to you. (Knock + + # on wood!) + + throttle("logins/email", :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + # return the email if present, nil otherwise + + req.params['email'].presence + end + end + +end From 69450b2d61b95d8da0d806a4b468ee6d387019bf Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 1 May 2021 17:48:25 +0800 Subject: [PATCH 10/11] breakman and bundle-audit --- Gemfile | 2 + Gemfile.lock | 245 +++++++++++++++++++++++++++------------------------ 2 files changed, 131 insertions(+), 116 deletions(-) diff --git a/Gemfile b/Gemfile index ec1e696..c3a1e22 100644 --- a/Gemfile +++ b/Gemfile @@ -57,6 +57,8 @@ group :development do # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring gem 'spring' gem 'spring-watcher-listen', '~> 2.0.0' + gem 'brakeman' + gem 'bundler-audit' end # Windows does not include zoneinfo files, so bundle the tzinfo-data gem diff --git a/Gemfile.lock b/Gemfile.lock index 90919e1..a8173fd 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,199 +1,212 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.0.2) - actionpack (= 5.0.2) + actioncable (5.0.7.2) + actionpack (= 5.0.7.2) nio4r (>= 1.2, < 3.0) websocket-driver (~> 0.6.1) - actionmailer (5.0.2) - actionpack (= 5.0.2) - actionview (= 5.0.2) - activejob (= 5.0.2) + actionmailer (5.0.7.2) + actionpack (= 5.0.7.2) + actionview (= 5.0.7.2) + activejob (= 5.0.7.2) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.0.2) - actionview (= 5.0.2) - activesupport (= 5.0.2) + actionpack (5.0.7.2) + actionview (= 5.0.7.2) + activesupport (= 5.0.7.2) rack (~> 2.0) rack-test (~> 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.0.2) - activesupport (= 5.0.2) + actionview (5.0.7.2) + activesupport (= 5.0.7.2) builder (~> 3.1) erubis (~> 2.7.0) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.0.2) - activesupport (= 5.0.2) + activejob (5.0.7.2) + activesupport (= 5.0.7.2) globalid (>= 0.3.6) - activemodel (5.0.2) - activesupport (= 5.0.2) - activerecord (5.0.2) - activemodel (= 5.0.2) - activesupport (= 5.0.2) + activemodel (5.0.7.2) + activesupport (= 5.0.7.2) + activerecord (5.0.7.2) + activemodel (= 5.0.7.2) + activesupport (= 5.0.7.2) arel (~> 7.0) - activesupport (5.0.2) + activesupport (5.0.7.2) concurrent-ruby (~> 1.0, >= 1.0.2) - i18n (~> 0.7) + i18n (>= 0.7, < 2) minitest (~> 5.1) tzinfo (~> 1.1) arel (7.1.4) - autoprefixer-rails (6.7.6) + autoprefixer-rails (10.2.4.0) execjs - bcrypt (3.1.11) - bindex (0.5.0) - bootstrap-sass (3.3.7) + bcrypt (3.1.16) + bindex (0.8.1) + bootstrap-sass (3.4.1) autoprefixer-rails (>= 5.2.1) - sass (>= 3.3.4) - builder (3.2.3) - byebug (9.0.6) - coffee-rails (4.2.1) + sassc (>= 2.0.0) + brakeman (5.0.1) + builder (3.2.4) + bundler-audit (0.8.0) + bundler (>= 1.2.0, < 3) + thor (~> 1.0) + byebug (11.1.3) + coffee-rails (4.2.2) coffee-script (>= 2.2.0) - railties (>= 4.0.0, < 5.2.x) + railties (>= 4.0.0) coffee-script (2.4.1) coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.0.5) - devise (4.2.0) + concurrent-ruby (1.1.8) + crass (1.0.6) + devise (4.8.0) bcrypt (~> 3.0) orm_adapter (~> 0.1) - railties (>= 4.1.0, < 5.1) + railties (>= 4.1.0) responders warden (~> 1.2.3) - diff-lcs (1.3) + diff-lcs (1.4.4) erubis (2.7.0) execjs (2.7.0) - faker (1.7.3) - i18n (~> 0.5) - ffi (1.9.18) - globalid (0.3.7) - activesupport (>= 4.1.0) - i18n (0.8.1) - jbuilder (2.6.3) - activesupport (>= 3.0.0, < 5.2) - multi_json (~> 1.2) - jquery-rails (4.3.1) + faker (2.17.0) + i18n (>= 1.6, < 2) + ffi (1.15.0) + globalid (0.4.2) + activesupport (>= 4.2.0) + i18n (1.8.10) + concurrent-ruby (~> 1.0) + jbuilder (2.11.2) + activesupport (>= 5.0.0) + jquery-rails (4.4.0) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) listen (3.0.8) rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) - loofah (2.0.3) + loofah (2.9.1) + crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.6.4) - mime-types (>= 1.16, < 4) - method_source (0.8.2) - mime-types (3.1) - mime-types-data (~> 3.2015) - mime-types-data (3.2016.0521) - mini_portile2 (2.1.0) - minitest (5.10.1) - multi_json (1.12.1) - nio4r (2.0.0) - nokogiri (1.7.1) - mini_portile2 (~> 2.1.0) + mail (2.7.1) + mini_mime (>= 0.1.1) + method_source (1.0.0) + mini_mime (1.1.0) + mini_portile2 (2.5.1) + minitest (5.14.4) + nio4r (2.5.7) + nokogiri (1.11.3) + mini_portile2 (~> 2.5.0) + racc (~> 1.4) orm_adapter (0.5.0) - puma (3.8.2) - rack (2.0.1) + puma (3.12.6) + racc (1.5.2) + rack (2.2.3) rack-attack (6.5.0) rack (>= 1.0, < 3) rack-test (0.6.3) rack (>= 1.0) - rails (5.0.2) - actioncable (= 5.0.2) - actionmailer (= 5.0.2) - actionpack (= 5.0.2) - actionview (= 5.0.2) - activejob (= 5.0.2) - activemodel (= 5.0.2) - activerecord (= 5.0.2) - activesupport (= 5.0.2) - bundler (>= 1.3.0, < 2.0) - railties (= 5.0.2) + rails (5.0.7.2) + actioncable (= 5.0.7.2) + actionmailer (= 5.0.7.2) + actionpack (= 5.0.7.2) + actionview (= 5.0.7.2) + activejob (= 5.0.7.2) + activemodel (= 5.0.7.2) + activerecord (= 5.0.7.2) + activesupport (= 5.0.7.2) + bundler (>= 1.3.0) + railties (= 5.0.7.2) sprockets-rails (>= 2.0.0) - rails-dom-testing (2.0.2) - activesupport (>= 4.2.0, < 6.0) - nokogiri (~> 1.6) - rails-html-sanitizer (1.0.3) - loofah (~> 2.0) - railties (5.0.2) - actionpack (= 5.0.2) - activesupport (= 5.0.2) + rails-dom-testing (2.0.3) + activesupport (>= 4.2.0) + nokogiri (>= 1.6) + rails-html-sanitizer (1.3.0) + loofah (~> 2.3) + railties (5.0.7.2) + actionpack (= 5.0.7.2) + activesupport (= 5.0.7.2) method_source rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) - rake (12.0.0) - rb-fsevent (0.9.8) - rb-inotify (0.9.8) - ffi (>= 0.5.0) - responders (2.3.0) - railties (>= 4.2.0, < 5.1) - rspec-core (3.5.4) - rspec-support (~> 3.5.0) - rspec-expectations (3.5.0) + rake (13.0.3) + rb-fsevent (0.10.4) + rb-inotify (0.10.1) + ffi (~> 1.0) + responders (3.0.1) + actionpack (>= 5.0) + railties (>= 5.0) + rspec-core (3.10.1) + rspec-support (~> 3.10.0) + rspec-expectations (3.10.1) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.5.0) - rspec-mocks (3.5.0) + rspec-support (~> 3.10.0) + rspec-mocks (3.10.2) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.5.0) - rspec-rails (3.5.2) - actionpack (>= 3.0) - activesupport (>= 3.0) - railties (>= 3.0) - rspec-core (~> 3.5.0) - rspec-expectations (~> 3.5.0) - rspec-mocks (~> 3.5.0) - rspec-support (~> 3.5.0) - rspec-support (3.5.0) - sass (3.4.23) - sass-rails (5.0.6) + rspec-support (~> 3.10.0) + rspec-rails (4.1.2) + actionpack (>= 4.2) + activesupport (>= 4.2) + railties (>= 4.2) + rspec-core (~> 3.10) + rspec-expectations (~> 3.10) + rspec-mocks (~> 3.10) + rspec-support (~> 3.10) + rspec-support (3.10.2) + sass (3.7.4) + sass-listen (~> 4.0.0) + sass-listen (4.0.0) + rb-fsevent (~> 0.9, >= 0.9.4) + rb-inotify (~> 0.9, >= 0.9.7) + sass-rails (5.0.7) railties (>= 4.0.0, < 6) sass (~> 3.1) sprockets (>= 2.8, < 4.0) sprockets-rails (>= 2.0, < 4.0) tilt (>= 1.1, < 3) - spring (2.0.1) - activesupport (>= 4.2) + sassc (2.4.0) + ffi (~> 1.9) + spring (2.1.1) spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) - sprockets (3.7.1) + sprockets (3.7.2) concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (3.2.0) + sprockets-rails (3.2.2) actionpack (>= 4.0) activesupport (>= 4.0) sprockets (>= 3.0.0) - sqlite3 (1.3.13) - thor (0.19.4) + sqlite3 (1.4.2) + thor (1.1.0) thread_safe (0.3.6) - tilt (2.0.7) - turbolinks (5.0.1) - turbolinks-source (~> 5) - turbolinks-source (5.0.0) - tzinfo (1.2.3) + tilt (2.0.10) + turbolinks (5.2.1) + turbolinks-source (~> 5.2) + turbolinks-source (5.2.0) + tzinfo (1.2.9) thread_safe (~> 0.1) - uglifier (3.2.0) + uglifier (4.2.0) execjs (>= 0.3.0, < 3) - warden (1.2.7) - rack (>= 1.0) - web-console (3.5.0) + warden (1.2.9) + rack (>= 2.0.9) + web-console (3.7.0) actionview (>= 5.0) activemodel (>= 5.0) bindex (>= 0.4.0) railties (>= 5.0) websocket-driver (0.6.5) websocket-extensions (>= 0.1.0) - websocket-extensions (0.1.2) + websocket-extensions (0.1.5) PLATFORMS ruby DEPENDENCIES bootstrap-sass + brakeman + bundler-audit byebug coffee-rails (~> 4.2) devise From 73361fe4b71ab0efe0975aeeedcdb39751f14dd1 Mon Sep 17 00:00:00 2001 From: RealAnalysis Date: Sat, 1 May 2021 18:11:29 +0800 Subject: [PATCH 11/11] change sqlite3 version --- Gemfile | 2 +- Gemfile.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile b/Gemfile index c3a1e22..00b3e54 100644 --- a/Gemfile +++ b/Gemfile @@ -14,7 +14,7 @@ gem 'bootstrap-sass' gem 'devise' # Use sqlite3 as the database for Active Record -gem 'sqlite3' +gem 'sqlite3', '~> 1.3.0' # Use Puma as the app server gem 'puma', '~> 3.0' # Use SCSS for stylesheets diff --git a/Gemfile.lock b/Gemfile.lock index a8173fd..3151ce5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -178,7 +178,7 @@ GEM actionpack (>= 4.0) activesupport (>= 4.0) sprockets (>= 3.0.0) - sqlite3 (1.4.2) + sqlite3 (1.3.13) thor (1.1.0) thread_safe (0.3.6) tilt (2.0.10) @@ -221,7 +221,7 @@ DEPENDENCIES sass-rails (~> 5.0) spring spring-watcher-listen (~> 2.0.0) - sqlite3 + sqlite3 (~> 1.3.0) turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0)