diff options
Diffstat (limited to 'actionpack/test/controller/render_test.rb')
-rw-r--r-- | actionpack/test/controller/render_test.rb | 53 |
1 files changed, 47 insertions, 6 deletions
diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb index bc42c6614a..de80b78272 100644 --- a/actionpack/test/controller/render_test.rb +++ b/actionpack/test/controller/render_test.rb @@ -70,6 +70,10 @@ class TestController < ActionController::Base render :file => file end + def dynamic_inline_render + render :inline => "<%= render(params) %>" + end + def conditional_hello_with_public_header if stale?(:last_modified => Time.now.utc.beginning_of_day, :etag => [:foo, 123], :public => true) render :action => 'hello_world' @@ -245,12 +249,6 @@ class TestController < ActionController::Base render :inline => "<%= action_name %>" end - def test_dynamic_render_file_hash - assert_raises ArgumentError do - get :dynamic_render, { :id => { :file => '../\\../test/abstract_unit.rb' } } - end - end - def accessing_controller_name_in_template render :inline => "<%= controller_name %>" end @@ -742,6 +740,15 @@ class MetalTestController < ActionController::Metal end end +class MetalWithoutAVTestController < ActionController::Metal + include AbstractController::Rendering + include ActionController::Rendering + + def dynamic_params_render + render params + end +end + class RenderTest < ActionController::TestCase tests TestController @@ -783,6 +790,29 @@ class RenderTest < ActionController::TestCase end end + def test_dynamic_render_file_hash + assert_raises ArgumentError do + get :dynamic_render, { :id => { :file => '../\\../test/abstract_unit.rb' } } + end + end + + def test_dynamic_inline + assert_raises ArgumentError do + get :dynamic_render, { :id => { :inline => '<%= RUBY_VERSION %>' } } + end + end + + def test_dynamic_render_on_view + file = Tempfile.new('_name') + file.write "secrets!" + file.flush + + e = assert_raises ActionView::Template::Error do + get :dynamic_inline_render, { :file => file.path } + end + assert_equal "render parameters are not permitted", e.message + end + # :ported: def test_simple_show get :hello_world @@ -1657,3 +1687,14 @@ class MetalRenderTest < ActionController::TestCase assert_equal "NilClass", @response.body end end + +class MetalRenderWithoutAVTest < ActionController::TestCase + tests MetalWithoutAVTestController + + def test_dynamic_params_render + e = assert_raises ArgumentError do + get :dynamic_params_render, { inline: '<%= RUBY_VERSION %>' } + end + assert_equal "render parameters are not permitted", e.message + end +end |