diff options
| author | Jon Moss <me@jonathanmoss.me> | 2016-12-19 21:24:12 -0500 |
|---|---|---|
| committer | Jon Moss <me@jonathanmoss.me> | 2016-12-20 15:07:33 -0500 |
| commit | c79c40ed82186fc5000cf5beea697b286422bcdb (patch) | |
| tree | 4456306037dc329a2732d6aaa0227ccdf187974c | |
| parent | b50090a561ef5baca752fea3874a5c12b28fffbc (diff) | |
| download | rails-c79c40ed82186fc5000cf5beea697b286422bcdb.tar.gz rails-c79c40ed82186fc5000cf5beea697b286422bcdb.tar.bz2 rails-c79c40ed82186fc5000cf5beea697b286422bcdb.zip | |
Limit length of secret being passed
Very similar to PR #25758, see more in depth reasoning there.
| -rw-r--r-- | railties/test/application/middleware/session_test.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/railties/test/application/middleware/session_test.rb b/railties/test/application/middleware/session_test.rb index 0e4acfdcec..959a629ede 100644 --- a/railties/test/application/middleware/session_test.rb +++ b/railties/test/application/middleware/session_test.rb @@ -173,7 +173,7 @@ module ApplicationTests secret = app.key_generator.generate_key("encrypted cookie") sign_secret = app.key_generator.generate_key("signed encrypted cookie") - encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret) + encryptor = ActiveSupport::MessageEncryptor.new(secret[0, ActiveSupport::MessageEncryptor.key_len], sign_secret) get "/foo/read_raw_cookie" assert_equal 1, encryptor.decrypt_and_verify(last_response.body)["foo"] @@ -222,7 +222,7 @@ module ApplicationTests secret = app.key_generator.generate_key("encrypted cookie") sign_secret = app.key_generator.generate_key("signed encrypted cookie") - encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret) + encryptor = ActiveSupport::MessageEncryptor.new(secret[0, ActiveSupport::MessageEncryptor.key_len], sign_secret) get "/foo/read_raw_cookie" assert_equal 1, encryptor.decrypt_and_verify(last_response.body)["foo"] @@ -281,7 +281,7 @@ module ApplicationTests secret = app.key_generator.generate_key("encrypted cookie") sign_secret = app.key_generator.generate_key("signed encrypted cookie") - encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret) + encryptor = ActiveSupport::MessageEncryptor.new(secret[0, ActiveSupport::MessageEncryptor.key_len], sign_secret) get "/foo/read_raw_cookie" assert_equal 2, encryptor.decrypt_and_verify(last_response.body)["foo"] |