diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2012-07-26 13:30:15 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2012-07-26 15:08:40 -0700 |
| commit | fee0bc57385b564b2789d199969ac26409603188 (patch) | |
| tree | 158f62df5e96919fd907afbe0b7040aba728e7f0 /actionpack | |
| parent | 90c9ae58010ee1a00c0eb5637533ed8b5e216ac2 (diff) | |
| download | rails-fee0bc57385b564b2789d199969ac26409603188.tar.gz rails-fee0bc57385b564b2789d199969ac26409603188.tar.bz2 rails-fee0bc57385b564b2789d199969ac26409603188.zip | |
* Do not convert digest auth strings to symbols. CVE-2012-3424
Conflicts:
actionpack/lib/action_controller/metal/http_authentication.rb
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/lib/action_controller/metal/http_authentication.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index 0050ede806..d84588d3df 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -229,9 +229,9 @@ module ActionController end def decode_credentials(header) - Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| + HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| key, value = pair.split('=', 2) - [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').delete('\'')] + [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')] end] end |