diff options
author | Jose and Yehuda <wycats@gmail.com> | 2012-04-24 22:32:09 -0500 |
---|---|---|
committer | Jose and Yehuda <wycats@gmail.com> | 2012-04-24 22:52:26 -0500 |
commit | 56cdc81c08b1847c5c1f699810a8c3b9ac3715a6 (patch) | |
tree | a896641a85a55eab01eb74a129dbcbb09f7f8b6b /railties | |
parent | 0cc32c5fd7f875de61262b430bca23825691899b (diff) | |
download | rails-56cdc81c08b1847c5c1f699810a8c3b9ac3715a6.tar.gz rails-56cdc81c08b1847c5c1f699810a8c3b9ac3715a6.tar.bz2 rails-56cdc81c08b1847c5c1f699810a8c3b9ac3715a6.zip |
Remove default match without specified method
In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.
In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.
This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.
Closes #5964
Diffstat (limited to 'railties')
-rw-r--r-- | railties/lib/rails/application/finisher.rb | 2 | ||||
-rw-r--r-- | railties/lib/rails/engine.rb | 8 | ||||
-rw-r--r-- | railties/test/application/asset_debugging_test.rb | 2 | ||||
-rw-r--r-- | railties/test/application/assets_test.rb | 10 | ||||
-rw-r--r-- | railties/test/application/initializers/frameworks_test.rb | 2 | ||||
-rw-r--r-- | railties/test/application/initializers/i18n_test.rb | 4 | ||||
-rw-r--r-- | railties/test/application/loading_test.rb | 16 | ||||
-rw-r--r-- | railties/test/application/middleware/cache_test.rb | 2 | ||||
-rw-r--r-- | railties/test/application/middleware/exceptions_test.rb | 2 | ||||
-rw-r--r-- | railties/test/application/route_inspect_test.rb | 14 | ||||
-rw-r--r-- | railties/test/application/routing_test.rb | 20 | ||||
-rw-r--r-- | railties/test/application/url_generation_test.rb | 2 | ||||
-rw-r--r-- | railties/test/isolation/abstract_unit.rb | 6 | ||||
-rw-r--r-- | railties/test/rails_info_controller_test.rb | 2 | ||||
-rw-r--r-- | railties/test/railties/engine_test.rb | 32 | ||||
-rw-r--r-- | railties/test/railties/mounted_engine_test.rb | 22 |
16 files changed, 73 insertions, 73 deletions
diff --git a/railties/lib/rails/application/finisher.rb b/railties/lib/rails/application/finisher.rb index 7da495211d..002c6026e4 100644 --- a/railties/lib/rails/application/finisher.rb +++ b/railties/lib/rails/application/finisher.rb @@ -22,7 +22,7 @@ module Rails initializer :add_builtin_route do |app| if Rails.env.development? app.routes.append do - match '/rails/info/properties' => "rails/info#properties" + get '/rails/info/properties' => "rails/info#properties" end end end diff --git a/railties/lib/rails/engine.rb b/railties/lib/rails/engine.rb index 131d6e5711..43ee396cbe 100644 --- a/railties/lib/rails/engine.rb +++ b/railties/lib/rails/engine.rb @@ -148,7 +148,7 @@ module Rails # # # ENGINE/config/routes.rb # MyEngine::Engine.routes.draw do - # match "/" => "posts#index" + # get "/" => "posts#index" # end # # == Mount priority @@ -158,7 +158,7 @@ module Rails # # MyRailsApp::Application.routes.draw do # mount MyEngine::Engine => "/blog" - # match "/blog/omg" => "main#omg" + # get "/blog/omg" => "main#omg" # end # # +MyEngine+ is mounted at <tt>/blog</tt>, and <tt>/blog/omg</tt> points to application's @@ -167,7 +167,7 @@ module Rails # It's much better to swap that: # # MyRailsApp::Application.routes.draw do - # match "/blog/omg" => "main#omg" + # get "/blog/omg" => "main#omg" # mount MyEngine::Engine => "/blog" # end # @@ -256,7 +256,7 @@ module Rails # # config/routes.rb # MyApplication::Application.routes.draw do # mount MyEngine::Engine => "/my_engine", :as => "my_engine" - # match "/foo" => "foo#index" + # get "/foo" => "foo#index" # end # # Now, you can use the <tt>my_engine</tt> helper inside your application: diff --git a/railties/test/application/asset_debugging_test.rb b/railties/test/application/asset_debugging_test.rb index 1ac349a560..ecacb34cb2 100644 --- a/railties/test/application/asset_debugging_test.rb +++ b/railties/test/application/asset_debugging_test.rb @@ -15,7 +15,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match '/posts', :to => "posts#index" + get '/posts', :to => "posts#index" end RUBY diff --git a/railties/test/application/assets_test.rb b/railties/test/application/assets_test.rb index 37981917e3..e23a19d69c 100644 --- a/railties/test/application/assets_test.rb +++ b/railties/test/application/assets_test.rb @@ -28,7 +28,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '*path', :to => lambda { |env| [200, { "Content-Type" => "text/html" }, "Not an asset"] } + get '*path', :to => lambda { |env| [200, { "Content-Type" => "text/html" }, "Not an asset"] } end RUBY @@ -204,7 +204,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match '/posts', :to => "posts#index" + get '/posts', :to => "posts#index" end RUBY @@ -230,7 +230,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match '/posts', :to => "posts#index" + get '/posts', :to => "posts#index" end RUBY @@ -334,7 +334,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match '/omg', :to => "omg#index" + get '/omg', :to => "omg#index" end RUBY @@ -513,7 +513,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match '/posts', :to => "posts#index" + get '/posts', :to => "posts#index" end RUBY end diff --git a/railties/test/application/initializers/frameworks_test.rb b/railties/test/application/initializers/frameworks_test.rb index a08e5b2374..c2d4a0f2c8 100644 --- a/railties/test/application/initializers/frameworks_test.rb +++ b/railties/test/application/initializers/frameworks_test.rb @@ -116,7 +116,7 @@ module ApplicationTests app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match "/:controller(/:action)" + get "/:controller(/:action)" end RUBY diff --git a/railties/test/application/initializers/i18n_test.rb b/railties/test/application/initializers/i18n_test.rb index abb277dc1d..02d20bc150 100644 --- a/railties/test/application/initializers/i18n_test.rb +++ b/railties/test/application/initializers/i18n_test.rb @@ -85,7 +85,7 @@ en: app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/i18n', :to => lambda { |env| [200, {}, [Foo.instance_variable_get('@foo')]] } + get '/i18n', :to => lambda { |env| [200, {}, [Foo.instance_variable_get('@foo')]] } end RUBY @@ -109,7 +109,7 @@ en: app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/i18n', :to => lambda { |env| [200, {}, [I18n.t(:foo)]] } + get '/i18n', :to => lambda { |env| [200, {}, [I18n.t(:foo)]] } end RUBY diff --git a/railties/test/application/loading_test.rb b/railties/test/application/loading_test.rb index 92951e1676..e0286502f3 100644 --- a/railties/test/application/loading_test.rb +++ b/railties/test/application/loading_test.rb @@ -77,8 +77,8 @@ class LoadingTest < ActiveSupport::TestCase app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/load', :to => lambda { |env| [200, {}, Post.all] } - match '/unload', :to => lambda { |env| [200, {}, []] } + get '/load', :to => lambda { |env| [200, {}, Post.all] } + get '/unload', :to => lambda { |env| [200, {}, []] } end RUBY @@ -107,7 +107,7 @@ class LoadingTest < ActiveSupport::TestCase app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/c', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [User.counter.to_s]] } + get '/c', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [User.counter.to_s]] } end RUBY @@ -146,7 +146,7 @@ class LoadingTest < ActiveSupport::TestCase app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/c', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [User.counter.to_s]] } + get '/c', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [User.counter.to_s]] } end RUBY @@ -182,7 +182,7 @@ class LoadingTest < ActiveSupport::TestCase app_file 'config/routes.rb', <<-RUBY $counter = 0 AppTemplate::Application.routes.draw do - match '/c', :to => lambda { |env| User; [200, {"Content-Type" => "text/plain"}, [$counter.to_s]] } + get '/c', :to => lambda { |env| User; [200, {"Content-Type" => "text/plain"}, [$counter.to_s]] } end RUBY @@ -213,8 +213,8 @@ class LoadingTest < ActiveSupport::TestCase app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match '/title', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [Post.new.title]] } - match '/body', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [Post.new.body]] } + get '/title', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [Post.new.title]] } + get '/body', :to => lambda { |env| [200, {"Content-Type" => "text/plain"}, [Post.new.body]] } end RUBY @@ -272,7 +272,7 @@ class LoadingTest < ActiveSupport::TestCase app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match "/:controller(/:action)" + get "/:controller(/:action)" end RUBY diff --git a/railties/test/application/middleware/cache_test.rb b/railties/test/application/middleware/cache_test.rb index 561b020707..54b18542c2 100644 --- a/railties/test/application/middleware/cache_test.rb +++ b/railties/test/application/middleware/cache_test.rb @@ -46,7 +46,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller(/:action)' + get ':controller(/:action)' end RUBY end diff --git a/railties/test/application/middleware/exceptions_test.rb b/railties/test/application/middleware/exceptions_test.rb index c5048afa13..d1a614e181 100644 --- a/railties/test/application/middleware/exceptions_test.rb +++ b/railties/test/application/middleware/exceptions_test.rb @@ -105,7 +105,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller(/:action)' + post ':controller(/:action)' end RUBY diff --git a/railties/test/application/route_inspect_test.rb b/railties/test/application/route_inspect_test.rb index 6393cfff4b..574c2a204f 100644 --- a/railties/test/application/route_inspect_test.rb +++ b/railties/test/application/route_inspect_test.rb @@ -83,7 +83,7 @@ module ApplicationTests def test_inspect_routes_shows_dynamic_action_route @set.draw do - match 'api/:action' => 'api' + get 'api/:action' => 'api' end output = @inspector.format @set.routes assert_equal [" /api/:action(.:format) api#:action"], output @@ -91,7 +91,7 @@ module ApplicationTests def test_inspect_routes_shows_controller_and_action_only_route @set.draw do - match ':controller/:action' + get ':controller/:action' end output = @inspector.format @set.routes assert_equal [" /:controller/:action(.:format) :controller#:action"], output @@ -99,7 +99,7 @@ module ApplicationTests def test_inspect_routes_shows_controller_and_action_route_with_constraints @set.draw do - match ':controller(/:action(/:id))', :id => /\d+/ + get ':controller(/:action(/:id))', :id => /\d+/ end output = @inspector.format @set.routes assert_equal [" /:controller(/:action(/:id))(.:format) :controller#:action {:id=>/\\d+/}"], output @@ -107,7 +107,7 @@ module ApplicationTests def test_rake_routes_shows_route_with_defaults @set.draw do - match 'photos/:id' => 'photos#show', :defaults => {:format => 'jpg'} + get 'photos/:id' => 'photos#show', :defaults => {:format => 'jpg'} end output = @inspector.format @set.routes assert_equal [%Q[ /photos/:id(.:format) photos#show {:format=>"jpg"}]], output @@ -115,7 +115,7 @@ module ApplicationTests def test_rake_routes_shows_route_with_constraints @set.draw do - match 'photos/:id' => 'photos#show', :id => /[A-Z]\d{5}/ + get 'photos/:id' => 'photos#show', :id => /[A-Z]\d{5}/ end output = @inspector.format @set.routes assert_equal [" /photos/:id(.:format) photos#show {:id=>/[A-Z]\\d{5}/}"], output @@ -128,7 +128,7 @@ module ApplicationTests def test_rake_routes_shows_route_with_rack_app @set.draw do - match 'foo/:id' => RackApp, :id => /[A-Z]\d{5}/ + get 'foo/:id' => RackApp, :id => /[A-Z]\d{5}/ end output = @inspector.format @set.routes assert_equal [" /foo/:id(.:format) #{RackApp.name} {:id=>/[A-Z]\\d{5}/}"], output @@ -153,7 +153,7 @@ module ApplicationTests def test_rake_routes_dont_show_app_mounted_in_assets_prefix @set.draw do - match '/sprockets' => RackApp + get '/sprockets' => RackApp end output = @inspector.format @set.routes assert_no_match(/RackApp/, output.first) diff --git a/railties/test/application/routing_test.rb b/railties/test/application/routing_test.rb index 28ce3beea9..204f43a442 100644 --- a/railties/test/application/routing_test.rb +++ b/railties/test/application/routing_test.rb @@ -53,7 +53,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller(/:action)' + get ':controller(/:action)' end RUBY @@ -94,7 +94,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller(/:action)' + get ':controller(/:action)' end RUBY @@ -126,8 +126,8 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match 'admin/foo', :to => 'admin/foo#index' - match 'foo', :to => 'foo#index' + get 'admin/foo', :to => 'admin/foo#index' + get 'foo', :to => 'foo#index' end RUBY @@ -141,13 +141,13 @@ module ApplicationTests test "routes appending blocks" do app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller/:action' + get ':controller/:action' end RUBY add_to_config <<-R routes.append do - match '/win' => lambda { |e| [200, {'Content-Type'=>'text/plain'}, ['WIN']] } + get '/win' => lambda { |e| [200, {'Content-Type'=>'text/plain'}, ['WIN']] } end R @@ -158,7 +158,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-R AppTemplate::Application.routes.draw do - match 'lol' => 'hello#index' + get 'lol' => 'hello#index' end R @@ -182,7 +182,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match 'foo', :to => 'foo#bar' + get 'foo', :to => 'foo#bar' end RUBY @@ -193,7 +193,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match 'foo', :to => 'foo#baz' + get 'foo', :to => 'foo#baz' end RUBY @@ -214,7 +214,7 @@ module ApplicationTests app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match 'foo', :to => ::InitializeRackApp + get 'foo', :to => ::InitializeRackApp end RUBY diff --git a/railties/test/application/url_generation_test.rb b/railties/test/application/url_generation_test.rb index 85a8a15fcc..f7e60749a7 100644 --- a/railties/test/application/url_generation_test.rb +++ b/railties/test/application/url_generation_test.rb @@ -31,7 +31,7 @@ module ApplicationTests end MyApp.routes.draw do - match "/" => "omg#index", :as => :omg + get "/" => "omg#index", :as => :omg end require 'rack/test' diff --git a/railties/test/isolation/abstract_unit.rb b/railties/test/isolation/abstract_unit.rb index ac4c2abfc8..b28cc6e04d 100644 --- a/railties/test/isolation/abstract_unit.rb +++ b/railties/test/isolation/abstract_unit.rb @@ -112,7 +112,7 @@ module TestHelpers routes = File.read("#{app_path}/config/routes.rb") if routes =~ /(\n\s*end\s*)\Z/ File.open("#{app_path}/config/routes.rb", 'w') do |f| - f.puts $` + "\nmatch ':controller(/:action(/:id))(.:format)'\n" + $1 + f.puts $` + "\nmatch ':controller(/:action(/:id))(.:format)', :via => :all\n" + $1 end end @@ -143,7 +143,7 @@ module TestHelpers app.initialize! app.routes.draw do - match "/" => "omg#index" + get "/" => "omg#index" end require 'rack/test' @@ -161,7 +161,7 @@ module TestHelpers app_file 'config/routes.rb', <<-RUBY AppTemplate::Application.routes.draw do - match ':controller(/:action)' + get ':controller(/:action)' end RUBY end diff --git a/railties/test/rails_info_controller_test.rb b/railties/test/rails_info_controller_test.rb index 8a9363fb80..f7a30a16d2 100644 --- a/railties/test/rails_info_controller_test.rb +++ b/railties/test/rails_info_controller_test.rb @@ -11,7 +11,7 @@ class InfoControllerTest < ActionController::TestCase def setup Rails.application.routes.draw do - match '/rails/info/properties' => "rails/info#properties" + get '/rails/info/properties' => "rails/info#properties" end @request.stubs(:local? => true) @controller.stubs(:consider_all_requests_local? => false) diff --git a/railties/test/railties/engine_test.rb b/railties/test/railties/engine_test.rb index 5e93a8e783..beae2c5f2c 100644 --- a/railties/test/railties/engine_test.rb +++ b/railties/test/railties/engine_test.rb @@ -218,7 +218,7 @@ module RailtiesTest end Rails.application.routes.draw do - match "/sprokkit", :to => Sprokkit + get "/sprokkit", :to => Sprokkit end RUBY @@ -241,7 +241,7 @@ module RailtiesTest app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match 'foo', :to => 'foo#index' + get 'foo', :to => 'foo#index' end RUBY @@ -255,8 +255,8 @@ module RailtiesTest @plugin.write "config/routes.rb", <<-RUBY Rails.application.routes.draw do - match 'foo', :to => 'bar#index' - match 'bar', :to => 'bar#index' + get 'foo', :to => 'bar#index' + get 'bar', :to => 'bar#index' end RUBY @@ -336,7 +336,7 @@ YAML Rails.application.routes.draw do namespace :admin do namespace :foo do - match "bar", :to => "bar#index" + get "bar", :to => "bar#index" end end end @@ -491,7 +491,7 @@ YAML @plugin.write "config/routes.rb", <<-RUBY Bukkits::Engine.routes.draw do - match "/foo" => lambda { |env| [200, {'Content-Type' => 'text/html'}, ['foo']] } + get "/foo" => lambda { |env| [200, {'Content-Type' => 'text/html'}, ['foo']] } end RUBY @@ -570,18 +570,18 @@ YAML app_file "config/routes.rb", <<-RUBY AppTemplate::Application.routes.draw do - match "/bar" => "bar#index", :as => "bar" + get "/bar" => "bar#index", :as => "bar" mount Bukkits::Engine => "/bukkits", :as => "bukkits" end RUBY @plugin.write "config/routes.rb", <<-RUBY Bukkits::Engine.routes.draw do - match "/foo" => "foo#index", :as => "foo" - match "/foo/show" => "foo#show" - match "/from_app" => "foo#from_app" - match "/routes_helpers_in_view" => "foo#routes_helpers_in_view" - match "/polymorphic_path_without_namespace" => "foo#polymorphic_path_without_namespace" + get "/foo" => "foo#index", :as => "foo" + get "/foo/show" => "foo#show" + get "/from_app" => "foo#from_app" + get "/routes_helpers_in_view" => "foo#routes_helpers_in_view" + get "/polymorphic_path_without_namespace" => "foo#polymorphic_path_without_namespace" resources :posts end RUBY @@ -738,7 +738,7 @@ YAML @plugin.write "config/routes.rb", <<-RUBY Bukkits::Awesome::Engine.routes.draw do - match "/foo" => "foo#index" + get "/foo" => "foo#index" end RUBY @@ -1008,8 +1008,8 @@ YAML app_file "config/routes.rb", <<-RUBY Rails.application.routes.draw do - match "/foo" => "main#foo" - match "/bar" => "main#bar" + get "/foo" => "main#foo" + get "/bar" => "main#bar" end RUBY @@ -1080,7 +1080,7 @@ YAML app_file "config/routes.rb", <<-RUBY Rails.application.routes.draw do - match "/foo" => "main#foo" + get "/foo" => "main#foo" end RUBY diff --git a/railties/test/railties/mounted_engine_test.rb b/railties/test/railties/mounted_engine_test.rb index 2bb9df6b64..4c0fdee556 100644 --- a/railties/test/railties/mounted_engine_test.rb +++ b/railties/test/railties/mounted_engine_test.rb @@ -18,13 +18,13 @@ module ApplicationTests AppTemplate::Application.routes.draw do mount Weblog::Engine, :at => '/', :as => 'weblog' resources :posts - match "/engine_route" => "application_generating#engine_route" - match "/engine_route_in_view" => "application_generating#engine_route_in_view" - match "/weblog_engine_route" => "application_generating#weblog_engine_route" - match "/weblog_engine_route_in_view" => "application_generating#weblog_engine_route_in_view" - match "/url_for_engine_route" => "application_generating#url_for_engine_route" - match "/polymorphic_route" => "application_generating#polymorphic_route" - match "/application_polymorphic_path" => "application_generating#application_polymorphic_path" + get "/engine_route" => "application_generating#engine_route" + get "/engine_route_in_view" => "application_generating#engine_route_in_view" + get "/weblog_engine_route" => "application_generating#weblog_engine_route" + get "/weblog_engine_route_in_view" => "application_generating#weblog_engine_route_in_view" + get "/url_for_engine_route" => "application_generating#url_for_engine_route" + get "/polymorphic_route" => "application_generating#polymorphic_route" + get "/application_polymorphic_path" => "application_generating#application_polymorphic_path" scope "/:user", :user => "anonymous" do mount Blog::Engine => "/blog" end @@ -42,7 +42,7 @@ module ApplicationTests @simple_plugin.write "config/routes.rb", <<-RUBY Weblog::Engine.routes.draw do - match '/weblog' => "weblogs#index", :as => 'weblogs' + get '/weblog' => "weblogs#index", :as => 'weblogs' end RUBY @@ -86,9 +86,9 @@ module ApplicationTests @plugin.write "config/routes.rb", <<-RUBY Blog::Engine.routes.draw do resources :posts - match '/generate_application_route', :to => 'posts#generate_application_route' - match '/application_route_in_view', :to => 'posts#application_route_in_view' - match '/engine_polymorphic_path', :to => 'posts#engine_polymorphic_path' + get '/generate_application_route', :to => 'posts#generate_application_route' + get '/application_route_in_view', :to => 'posts#application_route_in_view' + get '/engine_polymorphic_path', :to => 'posts#engine_polymorphic_path' end RUBY |