diff options
| author | Jeremy Kemper <jeremy@bitsweat.net> | 2013-01-05 17:46:26 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-01-08 12:03:34 -0800 |
| commit | 2ced6f2f8a85957b160710ae5d9fb245a6106550 (patch) | |
| tree | 49639ba51eea7ae97731e1ce3e8d15be954ba5e4 /actionpack | |
| parent | d99e8c9e1618f509bb35f052d4bd0d1848bce771 (diff) | |
| download | rails-2ced6f2f8a85957b160710ae5d9fb245a6106550.tar.gz rails-2ced6f2f8a85957b160710ae5d9fb245a6106550.tar.bz2 rails-2ced6f2f8a85957b160710ae5d9fb245a6106550.zip | |
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/test/controller/webservice_test.rb | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/actionpack/test/controller/webservice_test.rb b/actionpack/test/controller/webservice_test.rb index c0b9833603..2602540fbe 100644 --- a/actionpack/test/controller/webservice_test.rb +++ b/actionpack/test/controller/webservice_test.rb @@ -116,6 +116,19 @@ class WebServiceTest < ActionDispatch::IntegrationTest end end + def test_post_xml_using_a_disallowed_type_attribute + $stderr = StringIO.new + with_test_route_set do + post '/', '<foo type="symbol">value</foo>', 'CONTENT_TYPE' => 'application/xml' + assert_response 500 + + post '/', '<foo type="yaml">value</foo>', 'CONTENT_TYPE' => 'application/xml' + assert_response 500 + end + ensure + $stderr = STDERR + end + def test_register_and_use_yaml with_test_route_set do with_params_parsers Mime::YAML => Proc.new { |d| YAML.load(d) } do |