diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2014-02-13 19:29:08 +0100 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2014-02-13 19:29:08 +0100 |
commit | 9ec42f963feea891d7066843c17cd46963440e25 (patch) | |
tree | 8d112ad6de5d90079ce9f17a7549c2f20e6b0a3c /actionpack | |
parent | ad482673d7c3c4fa93efe9b6a91c822d8010dfa9 (diff) | |
parent | 00a4af9ab7e2008fe4e1a0cb1f31109a231d7279 (diff) | |
download | rails-9ec42f963feea891d7066843c17cd46963440e25.tar.gz rails-9ec42f963feea891d7066843c17cd46963440e25.tar.bz2 rails-9ec42f963feea891d7066843c17cd46963440e25.zip |
Merge pull request #14047 from strzalek/variants-array-check
Check if variant array contains only symbols
Diffstat (limited to 'actionpack')
-rw-r--r-- | actionpack/lib/action_dispatch/http/mime_negotiation.rb | 4 | ||||
-rw-r--r-- | actionpack/test/dispatch/request_test.rb | 8 |
2 files changed, 10 insertions, 2 deletions
diff --git a/actionpack/lib/action_dispatch/http/mime_negotiation.rb b/actionpack/lib/action_dispatch/http/mime_negotiation.rb index b75d7ffe9d..b803ce8b6f 100644 --- a/actionpack/lib/action_dispatch/http/mime_negotiation.rb +++ b/actionpack/lib/action_dispatch/http/mime_negotiation.rb @@ -70,10 +70,10 @@ module ActionDispatch def variant=(variant) if variant.is_a?(Symbol) @variant = [variant] - elsif variant.is_a?(Array) + elsif variant.is_a?(Array) && variant.any? && variant.all?{ |v| v.is_a?(Symbol) } @variant = variant else - raise ArgumentError, "request.variant must be set to a Symbol or Array, not a #{variant.class}. " \ + raise ArgumentError, "request.variant must be set to a Symbol or an Array of Symbols, not a #{variant.class}. " \ "For security reasons, never directly set the variant to a user-provided value, " \ "like params[:variant].to_sym. Check user-provided value against a whitelist first, " \ "then set the variant: request.variant = :tablet if params[:variant] == 'tablet'" diff --git a/actionpack/test/dispatch/request_test.rb b/actionpack/test/dispatch/request_test.rb index df47520850..40e32cb4d3 100644 --- a/actionpack/test/dispatch/request_test.rb +++ b/actionpack/test/dispatch/request_test.rb @@ -852,6 +852,14 @@ class RequestTest < ActiveSupport::TestCase request.variant = [:phone, :tablet] assert_equal [:phone, :tablet], request.variant + + assert_raise ArgumentError do + request.variant = [:phone, "tablet"] + end + + assert_raise ArgumentError do + request.variant = "yolo" + end end test "setting variant with non symbol value" do |