aboutsummaryrefslogtreecommitdiffstats
path: root/activesupport
diff options
context:
space:
mode:
authorRoque Pinel <repinel@gmail.com>2015-06-04 17:16:02 -0500
committerRoque Pinel <repinel@gmail.com>2015-06-14 11:35:27 -0400
commit4092f997f0c54564fea9ce68c2cf14d81c65ce87 (patch)
tree07e42bc6cc77d5e14187c0d488429c0056ab5a0c /activesupport
parent70902cfbdd84be20e1862e5b32f2c378e00570e1 (diff)
downloadrails-4092f997f0c54564fea9ce68c2cf14d81c65ce87.tar.gz
rails-4092f997f0c54564fea9ce68c2cf14d81c65ce87.tar.bz2
rails-4092f997f0c54564fea9ce68c2cf14d81c65ce87.zip
Fix the message verifier encoding issue
```ruby verifier = ActiveSupport::MessageVerifier.new('secret') verifier.verify("\xff") # => ArgumentError: invalid byte sequence in UTF-8 ```
Diffstat (limited to 'activesupport')
-rw-r--r--activesupport/lib/active_support/message_verifier.rb2
-rw-r--r--activesupport/test/message_verifier_test.rb1
2 files changed, 2 insertions, 1 deletions
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb
index eee9bbaead..b2a4404968 100644
--- a/activesupport/lib/active_support/message_verifier.rb
+++ b/activesupport/lib/active_support/message_verifier.rb
@@ -44,7 +44,7 @@ module ActiveSupport
# tampered_message = signed_message.chop # editing the message invalidates the signature
# verifier.valid_message?(tampered_message) # => false
def valid_message?(signed_message)
- return if signed_message.blank?
+ return if signed_message.nil? || !signed_message.valid_encoding? || signed_message.blank?
data, digest = signed_message.split("--")
data.present? && digest.present? && ActiveSupport::SecurityUtils.secure_compare(digest, generate_digest(data))
diff --git a/activesupport/test/message_verifier_test.rb b/activesupport/test/message_verifier_test.rb
index 6c3519df9a..668d78492e 100644
--- a/activesupport/test/message_verifier_test.rb
+++ b/activesupport/test/message_verifier_test.rb
@@ -24,6 +24,7 @@ class MessageVerifierTest < ActiveSupport::TestCase
data, hash = @verifier.generate(@data).split("--")
assert !@verifier.valid_message?(nil)
assert !@verifier.valid_message?("")
+ assert !@verifier.valid_message?("\xff") # invalid encoding
assert !@verifier.valid_message?("#{data.reverse}--#{hash}")
assert !@verifier.valid_message?("#{data}--#{hash.reverse}")
assert !@verifier.valid_message?("purejunk")