aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2013-02-09 17:00:59 -0800
committerAaron Patterson <aaron.patterson@gmail.com>2013-02-09 17:00:59 -0800
commitc35d913524966409721e96716217daca4e5ef5f3 (patch)
tree4aad9ded16c48481634c8ec3b269ff29dd13cb4e
parent060bb7250b963609a0d8a5d0559e36b99d2402c6 (diff)
downloadrails-c35d913524966409721e96716217daca4e5ef5f3.tar.gz
rails-c35d913524966409721e96716217daca4e5ef5f3.tar.bz2
rails-c35d913524966409721e96716217daca4e5ef5f3.zip
adding test for CVE
-rw-r--r--activerecord/test/cases/mass_assignment_security_test.rb10
1 files changed, 10 insertions, 0 deletions
diff --git a/activerecord/test/cases/mass_assignment_security_test.rb b/activerecord/test/cases/mass_assignment_security_test.rb
index 5153945546..13f90e8eef 100644
--- a/activerecord/test/cases/mass_assignment_security_test.rb
+++ b/activerecord/test/cases/mass_assignment_security_test.rb
@@ -300,6 +300,16 @@ class MassAssignmentSecurityTest < ActiveRecord::TestCase
assert_admin_attributes(p, true)
end
+ def test_attr_protected_with_newline
+ p = LoosePerson.new
+ assert_raises(ActiveRecord::UnknownAttributeError) do
+ p.attributes = {"comments=\n"=>"hax"}
+ end
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ p.attributes= {"comments(1)\n" => "hax"}
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ end
+
end