diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2013-04-09 09:22:42 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2013-04-09 09:22:42 -0700 |
| commit | 536f316cd3586e63675e6aba440763b4f0deee9c (patch) | |
| tree | 0657c1214383d8417f549726bd24e47b26c148a8 /activerecord | |
| parent | c9bd2022d42890f97f6f9f5896594f030c491add (diff) | |
| parent | c35d913524966409721e96716217daca4e5ef5f3 (diff) | |
| download | rails-536f316cd3586e63675e6aba440763b4f0deee9c.tar.gz rails-536f316cd3586e63675e6aba440763b4f0deee9c.tar.bz2 rails-536f316cd3586e63675e6aba440763b4f0deee9c.zip | |
Merge branch '3-2-later' into 3-2-stable
* 3-2-later:
adding test for CVE
Diffstat (limited to 'activerecord')
| -rw-r--r-- | activerecord/test/cases/mass_assignment_security_test.rb | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/activerecord/test/cases/mass_assignment_security_test.rb b/activerecord/test/cases/mass_assignment_security_test.rb index 5153945546..13f90e8eef 100644 --- a/activerecord/test/cases/mass_assignment_security_test.rb +++ b/activerecord/test/cases/mass_assignment_security_test.rb @@ -300,6 +300,16 @@ class MassAssignmentSecurityTest < ActiveRecord::TestCase assert_admin_attributes(p, true) end + def test_attr_protected_with_newline + p = LoosePerson.new + assert_raises(ActiveRecord::UnknownAttributeError) do + p.attributes = {"comments=\n"=>"hax"} + end + assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes=" + p.attributes= {"comments(1)\n" => "hax"} + assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes=" + end + end |