diff options
author | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-04-17 16:50:39 -0300 |
---|---|---|
committer | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-05-05 11:37:34 -0300 |
commit | 0f3b7d1a319383f743f9938e1eed00f0fba7a367 (patch) | |
tree | 57e8072a1d25458442a9cec90bd687dedf271f9b /actionpack/test/controller/new_base | |
parent | 666e9f65bdfeb6cc5aa80b6254608adc3d7845ce (diff) | |
download | rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.tar.gz rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.tar.bz2 rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.zip |
Only accept actions without File::SEPARATOR in the name.
This will avoid directory traversal in implicit render.
Fixes: CVE-2014-0130
Diffstat (limited to 'actionpack/test/controller/new_base')
-rw-r--r-- | actionpack/test/controller/new_base/render_implicit_action_test.rb | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb index 1e2191d417..5b4885f7e0 100644 --- a/actionpack/test/controller/new_base/render_implicit_action_test.rb +++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb @@ -6,7 +6,7 @@ module RenderImplicitAction "render_implicit_action/simple/hello_world.html.erb" => "Hello world!", "render_implicit_action/simple/hyphen-ated.html.erb" => "Hello hyphen-ated!", "render_implicit_action/simple/not_implemented.html.erb" => "Not Implemented" - )] + ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))] def hello_world() end end @@ -33,10 +33,25 @@ module RenderImplicitAction assert_status 200 end + test "render does not traverse the file system" do + assert_raises(AbstractController::ActionNotFound) do + action_name = %w(.. .. fixtures shared).join(File::SEPARATOR) + SimpleController.action(action_name).call(Rack::MockRequest.env_for("/")) + end + end + test "available_action? returns true for implicit actions" do assert SimpleController.new.available_action?(:hello_world) assert SimpleController.new.available_action?(:"hyphen-ated") assert SimpleController.new.available_action?(:not_implemented) end + + test "available_action? does not allow File::SEPARATOR on the name" do + action_name = %w(evil .. .. path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + + action_name = %w(evil path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + end end end |