aboutsummaryrefslogtreecommitdiffstats
path: root/activerecord/test/cases/finder_test.rb
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2012-12-23 11:07:07 -0800
committerAaron Patterson <aaron.patterson@gmail.com>2013-01-02 13:44:06 -0800
commit44930b2def7fe9a6f3bc199bb3cd86c35ffbaba3 (patch)
tree89245b0aa3238a74ffdbeb23d272d43b284b6b36 /activerecord/test/cases/finder_test.rb
parent8af674714c8af702f640d61920df8675baca6d64 (diff)
downloadrails-44930b2def7fe9a6f3bc199bb3cd86c35ffbaba3.tar.gz
rails-44930b2def7fe9a6f3bc199bb3cd86c35ffbaba3.tar.bz2
rails-44930b2def7fe9a6f3bc199bb3cd86c35ffbaba3.zip
CVE-2012-5664 options hashes should only be extracted if there are extra parameters
Conflicts: activerecord/lib/active_record/dynamic_matchers.rb
Diffstat (limited to 'activerecord/test/cases/finder_test.rb')
-rw-r--r--activerecord/test/cases/finder_test.rb12
1 files changed, 12 insertions, 0 deletions
diff --git a/activerecord/test/cases/finder_test.rb b/activerecord/test/cases/finder_test.rb
index 7db7953313..a9fa107749 100644
--- a/activerecord/test/cases/finder_test.rb
+++ b/activerecord/test/cases/finder_test.rb
@@ -15,6 +15,18 @@ require 'models/toy'
class FinderTest < ActiveRecord::TestCase
fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers, :categories, :categorizations
+ def test_find_by_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_id(:limit => 1)
+ end
+ end
+
+ def test_find_by_title_and_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_title_and_id('foo', :limit => 1)
+ end
+ end
+
def test_find
assert_equal(topics(:first).title, Topic.find(1).title)
end