diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2013-01-08 12:11:18 -0800 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-01-08 12:11:18 -0800 |
commit | 88cc1688d0cb828c17706b41a8bd27870f2a2beb (patch) | |
tree | 1001415a74aa4ba81cc8fc305f4cb7a0bc145afc /actionpack/test/dispatch/request/json_params_parsing_test.rb | |
parent | f049016cd348627bf8db0d72382d7580bf802a79 (diff) | |
parent | 2ced6f2f8a85957b160710ae5d9fb245a6106550 (diff) | |
download | rails-88cc1688d0cb828c17706b41a8bd27870f2a2beb.tar.gz rails-88cc1688d0cb828c17706b41a8bd27870f2a2beb.tar.bz2 rails-88cc1688d0cb828c17706b41a8bd27870f2a2beb.zip |
Merge branch 'master-sec'
* master-sec:
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
* Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu
Diffstat (limited to 'actionpack/test/dispatch/request/json_params_parsing_test.rb')
-rw-r--r-- | actionpack/test/dispatch/request/json_params_parsing_test.rb | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/actionpack/test/dispatch/request/json_params_parsing_test.rb b/actionpack/test/dispatch/request/json_params_parsing_test.rb index c0c3147e37..2c4a6c2147 100644 --- a/actionpack/test/dispatch/request/json_params_parsing_test.rb +++ b/actionpack/test/dispatch/request/json_params_parsing_test.rb @@ -30,6 +30,21 @@ class JsonParamsParsingTest < ActionDispatch::IntegrationTest ) end + test "nils are stripped from collections" do + assert_parses( + {"person" => nil}, + "{\"person\":[null]}", { 'CONTENT_TYPE' => 'application/json' } + ) + assert_parses( + {"person" => ['foo']}, + "{\"person\":[\"foo\",null]}", { 'CONTENT_TYPE' => 'application/json' } + ) + assert_parses( + {"person" => nil}, + "{\"person\":[null, null]}", { 'CONTENT_TYPE' => 'application/json' } + ) + end + test "logs error if parsing unsuccessful" do with_test_routing do output = StringIO.new |