diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-20 10:39:19 -0800 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-22 15:02:27 -0800 |
| commit | b7758b40fc035a47f6843158155606d455314c42 (patch) | |
| tree | 92e2bdb231a7dda8902e0563bdc98867098c298a /actionpack/lib | |
| parent | 0fde6f554b75b13b0435dd70f1c3ec02bc209e0d (diff) | |
| download | rails-b7758b40fc035a47f6843158155606d455314c42.tar.gz rails-b7758b40fc035a47f6843158155606d455314c42.tar.bz2 rails-b7758b40fc035a47f6843158155606d455314c42.zip | |
allow :file to be outside rails root, but anything else must be inside the rails view directory
CVE-2016-0752
Diffstat (limited to 'actionpack/lib')
| -rw-r--r-- | actionpack/lib/abstract_controller/rendering.rb | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/actionpack/lib/abstract_controller/rendering.rb b/actionpack/lib/abstract_controller/rendering.rb index a73f188623..63fd76d9b7 100644 --- a/actionpack/lib/abstract_controller/rendering.rb +++ b/actionpack/lib/abstract_controller/rendering.rb @@ -82,7 +82,13 @@ module AbstractController # <tt>render :file => "foo/bar"</tt>. # :api: plugin def _normalize_args(action=nil, options={}) - if action.is_a? Hash + case action + when ActionController::Parameters + unless action.permitted? + raise ArgumentError, "render parameters are not permitted" + end + action + when Hash action else options |