aboutsummaryrefslogtreecommitdiffstats
path: root/actionview
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2013-11-30 17:02:53 -0800
committerAaron Patterson <aaron.patterson@gmail.com>2013-12-02 16:41:09 -0800
commit2e3c3a87d81e16a2fed442c1cf31360f75737a83 (patch)
tree2fdc7cfab473b41ed07a0cefd36d7ccf54ae8185 /actionview
parent46923cabe156852bac1ae99c4509ff2780eae2a1 (diff)
downloadrails-2e3c3a87d81e16a2fed442c1cf31360f75737a83.tar.gz
rails-2e3c3a87d81e16a2fed442c1cf31360f75737a83.tar.bz2
rails-2e3c3a87d81e16a2fed442c1cf31360f75737a83.zip
Only use valid mime type symbols as cache keys
CVE-2013-6414
Diffstat (limited to 'actionview')
-rw-r--r--actionview/lib/action_view/lookup_context.rb7
1 files changed, 7 insertions, 0 deletions
diff --git a/actionview/lib/action_view/lookup_context.rb b/actionview/lib/action_view/lookup_context.rb
index f9d5b97fe3..c6ff683827 100644
--- a/actionview/lib/action_view/lookup_context.rb
+++ b/actionview/lib/action_view/lookup_context.rb
@@ -62,6 +62,13 @@ module ActionView
@details_keys = ThreadSafe::Cache.new
def self.get(details)
+ if details[:formats]
+ details = details.dup
+ syms = Set.new Mime::SET.symbols
+ details[:formats] = details[:formats].select { |v|
+ syms.include? v
+ }
+ end
@details_keys[details] ||= new
end