diff options
| author | Michael Koziarski <michael@koziarski.com> | 2013-11-30 16:45:23 +1300 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-12-02 14:14:35 -0800 |
| commit | d5a4095ca5725d5eebcce153d7d0738375146cef (patch) | |
| tree | 328632b6185b19991f7d86f67889fa42977197e0 /actionpack/lib | |
| parent | 78790e4bceedc632cb40f9597792d7e27234138a (diff) | |
| download | rails-d5a4095ca5725d5eebcce153d7d0738375146cef.tar.gz rails-d5a4095ca5725d5eebcce153d7d0738375146cef.tar.bz2 rails-d5a4095ca5725d5eebcce153d7d0738375146cef.zip | |
Deep Munge the parameters for GET and POST
The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.
Fixes CVE-2013-6417
Conflicts:
actionpack/lib/action_dispatch/http/request.rb
Diffstat (limited to 'actionpack/lib')
| -rw-r--r-- | actionpack/lib/action_dispatch/http/request.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb index 31155732d2..0f92b82b33 100644 --- a/actionpack/lib/action_dispatch/http/request.rb +++ b/actionpack/lib/action_dispatch/http/request.rb @@ -228,13 +228,13 @@ module ActionDispatch # Override Rack's GET method to support indifferent access def GET - @env["action_dispatch.request.query_parameters"] ||= (normalize_parameters(super) || {}) + @env["action_dispatch.request.query_parameters"] ||= deep_munge(normalize_parameters(super) || {}) end alias :query_parameters :GET # Override Rack's POST method to support indifferent access def POST - @env["action_dispatch.request.request_parameters"] ||= (normalize_parameters(super) || {}) + @env["action_dispatch.request.request_parameters"] ||= deep_munge(normalize_parameters(super) || {}) end alias :request_parameters :POST |