diff options
author | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-05-06 13:31:07 -0300 |
---|---|---|
committer | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-05-06 13:31:07 -0300 |
commit | bbec7d72bed585d24f3d0d827b4911e30a887708 (patch) | |
tree | 65c65beb5cf9e1992a993dd1ee8ac133f825653a /actionpack/test | |
parent | a3bda38467377cb8c3cdd52b6fcf6c6c31f74b82 (diff) | |
parent | 50d6b4549d56ac3a82f2096bd479a7b2305b0bf3 (diff) | |
download | rails-bbec7d72bed585d24f3d0d827b4911e30a887708.tar.gz rails-bbec7d72bed585d24f3d0d827b4911e30a887708.tar.bz2 rails-bbec7d72bed585d24f3d0d827b4911e30a887708.zip |
Merge branch '3-2-sec' into 3-2-stable
Conflicts:
actionpack/CHANGELOG.md
Diffstat (limited to 'actionpack/test')
-rw-r--r-- | actionpack/test/controller/new_base/render_implicit_action_test.rb | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/actionpack/test/controller/new_base/render_implicit_action_test.rb b/actionpack/test/controller/new_base/render_implicit_action_test.rb index 1e2191d417..5b4885f7e0 100644 --- a/actionpack/test/controller/new_base/render_implicit_action_test.rb +++ b/actionpack/test/controller/new_base/render_implicit_action_test.rb @@ -6,7 +6,7 @@ module RenderImplicitAction "render_implicit_action/simple/hello_world.html.erb" => "Hello world!", "render_implicit_action/simple/hyphen-ated.html.erb" => "Hello hyphen-ated!", "render_implicit_action/simple/not_implemented.html.erb" => "Not Implemented" - )] + ), ActionView::FileSystemResolver.new(File.expand_path('../../../controller', __FILE__))] def hello_world() end end @@ -33,10 +33,25 @@ module RenderImplicitAction assert_status 200 end + test "render does not traverse the file system" do + assert_raises(AbstractController::ActionNotFound) do + action_name = %w(.. .. fixtures shared).join(File::SEPARATOR) + SimpleController.action(action_name).call(Rack::MockRequest.env_for("/")) + end + end + test "available_action? returns true for implicit actions" do assert SimpleController.new.available_action?(:hello_world) assert SimpleController.new.available_action?(:"hyphen-ated") assert SimpleController.new.available_action?(:not_implemented) end + + test "available_action? does not allow File::SEPARATOR on the name" do + action_name = %w(evil .. .. path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + + action_name = %w(evil path).join(File::SEPARATOR) + assert_equal false, SimpleController.new.available_action?(action_name.to_sym) + end end end |