diff options
| author | Jeremy Kemper <jeremy@bitsweat.net> | 2013-01-05 17:46:26 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-01-08 12:42:29 -0800 |
| commit | 46e0d2397ea10a0bf380926c9fe3cfcf14d5c499 (patch) | |
| tree | 1001415a74aa4ba81cc8fc305f4cb7a0bc145afc /actionpack | |
| parent | 8e577fe560d5756fcc67840ba304d79ada6804e4 (diff) | |
| download | rails-46e0d2397ea10a0bf380926c9fe3cfcf14d5c499.tar.gz rails-46e0d2397ea10a0bf380926c9fe3cfcf14d5c499.tar.bz2 rails-46e0d2397ea10a0bf380926c9fe3cfcf14d5c499.zip | |
CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/test/controller/webservice_test.rb | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/actionpack/test/controller/webservice_test.rb b/actionpack/test/controller/webservice_test.rb index c0b9833603..2602540fbe 100644 --- a/actionpack/test/controller/webservice_test.rb +++ b/actionpack/test/controller/webservice_test.rb @@ -116,6 +116,19 @@ class WebServiceTest < ActionDispatch::IntegrationTest end end + def test_post_xml_using_a_disallowed_type_attribute + $stderr = StringIO.new + with_test_route_set do + post '/', '<foo type="symbol">value</foo>', 'CONTENT_TYPE' => 'application/xml' + assert_response 500 + + post '/', '<foo type="yaml">value</foo>', 'CONTENT_TYPE' => 'application/xml' + assert_response 500 + end + ensure + $stderr = STDERR + end + def test_register_and_use_yaml with_test_route_set do with_params_parsers Mime::YAML => Proc.new { |d| YAML.load(d) } do |