aboutsummaryrefslogtreecommitdiffstats
path: root/actionview/test/template/log_subscriber_test.rb
diff options
context:
space:
mode:
authorJohn Hawthorn <john@hawthorn.email>2019-03-18 17:17:11 -0700
committerJohn Hawthorn <john@hawthorn.email>2019-03-27 15:51:25 -0700
commitc7820d8124c854760a4d288334f185de2fb99446 (patch)
tree08b50d4f926f0fb19e4b7d8c45f963ce6a84546c /actionview/test/template/log_subscriber_test.rb
parent93dbbe3a81bee6da2f1e88ca6971299b462cad93 (diff)
downloadrails-c7820d8124c854760a4d288334f185de2fb99446.tar.gz
rails-c7820d8124c854760a4d288334f185de2fb99446.tar.bz2
rails-c7820d8124c854760a4d288334f185de2fb99446.zip
Introduce Template::File as new render file:
The previous behaviour of render file: was essentially the same as render template:, except that templates can be specified as an absolute path on the filesystem. This makes sense for historic reasons, but now render file: is almost exclusively used to render raw files (not .erb) like public/404.html. In addition to complicating the code in template/resolver.rb, I think the current behaviour is surprising to developers. This commit deprecates the existing "lookup a template from anywhere" behaviour and replaces it with "render this file exactly as it is on disk". Handlers will no longer be used (it will render the same as if the :raw handler was used), but formats (.html, .xml, etc) will still be detected (and will default to :plain). The existing render file: behaviour was the path through which Rails apps were vulnerable in the recent CVE-2019-5418. Although the vulnerability has been patched in a fully backwards-compatible way, I think it's a strong hint that we should drop the existing previously-vulnerable behaviour if it isn't a benefit to developers.
Diffstat (limited to 'actionview/test/template/log_subscriber_test.rb')
-rw-r--r--actionview/test/template/log_subscriber_test.rb13
1 files changed, 12 insertions, 1 deletions
diff --git a/actionview/test/template/log_subscriber_test.rb b/actionview/test/template/log_subscriber_test.rb
index 85735139c1..8b160a7336 100644
--- a/actionview/test/template/log_subscriber_test.rb
+++ b/actionview/test/template/log_subscriber_test.rb
@@ -51,9 +51,20 @@ class AVLogSubscriberTest < ActiveSupport::TestCase
def @view.combined_fragment_cache_key(*); "ahoy `controller` dependency"; end
end
+ def test_render_template_template
+ Rails.stub(:root, File.expand_path(FIXTURE_LOAD_PATH)) do
+ @view.render(template: "test/hello_world")
+ wait
+
+ assert_equal 2, @logger.logged(:info).size
+ assert_match(/Rendering test\/hello_world\.erb/, @logger.logged(:info).first)
+ assert_match(/Rendered test\/hello_world\.erb/, @logger.logged(:info).last)
+ end
+ end
+
def test_render_file_template
Rails.stub(:root, File.expand_path(FIXTURE_LOAD_PATH)) do
- @view.render(file: "test/hello_world")
+ @view.render(file: "#{FIXTURE_LOAD_PATH}/test/hello_world.erb")
wait
assert_equal 2, @logger.logged(:info).size