diff options
| author | Eileen M. Uchitelle <eileencodes@users.noreply.github.com> | 2018-05-30 09:20:43 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-05-30 09:20:43 -0400 |
| commit | 10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d (patch) | |
| tree | 4cd7feb281301bf327d530e08fa47e5818cec9f1 | |
| parent | ced104d57997c7bceef3d1e6c8a713431363c3bb (diff) | |
| parent | d3a2c53955f28e0f3dfe0403ef691b903496e957 (diff) | |
| download | rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.tar.gz rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.tar.bz2 rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.zip | |
Merge pull request #32998 from gregmolnar/protect-from-application-javascript
Include application/javascript when checking content_type
| -rw-r--r-- | actionpack/lib/action_controller/metal/request_forgery_protection.rb | 2 | ||||
| -rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb index 953f3c47ed..df15c45470 100644 --- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb @@ -275,7 +275,7 @@ module ActionController #:nodoc: # Check for cross-origin JavaScript responses. def non_xhr_javascript_response? # :doc: - content_type =~ %r(\Atext/javascript) && !request.xhr? + content_type =~ %r(\A(text|application)/javascript) && !request.xhr? end AUTHENTICITY_TOKEN_LENGTH = 32 diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index 7a02c27c99..ea94a3e048 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -521,6 +521,11 @@ module RequestForgeryProtectionTests get :negotiate_same_origin end + assert_cross_origin_blocked do + @request.accept = "application/javascript" + get :negotiate_same_origin + end + assert_cross_origin_not_blocked { get :same_origin_js, xhr: true } assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: "js" } assert_cross_origin_not_blocked do |