1 files changed, 46 insertions, 33 deletions
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index 868520a219..f3b0ecac10 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -1,5 +1,4 @@
 require 'abstract_unit'
-require 'digest/sha1'
 require "active_support/log_subscriber/test_helper"
 
 # common controller actions
@@ -133,7 +132,6 @@ end
 module RequestForgeryProtectionTests
   def setup
     @token      = "cf50faa3fe97702ca1ae"
-    @controller.stubs(:form_authenticity_token).returns(@token)
     @controller.stubs(:valid_authenticity_token?).with{ |_, t| t == @token }.returns(true)
     @controller.stubs(:valid_authenticity_token?).with{ |_, t| t != @token }.returns(false)
     @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
@@ -145,17 +143,21 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_render_form_with_token_tag
-    assert_not_blocked do
-      get :index
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :index
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_button_to_with_token_tag
-    assert_not_blocked do
-      get :show_button
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :show_button
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_form_without_token_tag_if_remote
@@ -199,17 +201,21 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_remote_with_token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :form_for_remote_with_token
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_render_form_with_token_tag_with_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_with_token
+    @controller.stub :form_authenticity_token, @token do
+      assert_not_blocked do
+        get :form_for_with_token
+      end
+      assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
     end
-    assert_select 'form>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
   def test_should_allow_get
@@ -402,11 +408,12 @@ class RequestForgeryProtectionControllerUsingResetSessionTest < ActionController
   end
 
   test 'should emit a csrf-param meta tag and a csrf-token meta tag' do
-    @controller.stubs(:form_authenticity_token).returns(@token + '<=?')
-    get :meta
-    assert_select 'meta[name=?][content=?]', 'csrf-param', 'custom_authenticity_token'
-    assert_select 'meta[name=?]', 'csrf-token'
-    assert_match(/cf50faa3fe97702ca1ae&lt;=\?/, @response.body)
+    @controller.stub :form_authenticity_token, @token + '<=?' do
+      get :meta
+      assert_select 'meta[name=?][content=?]', 'csrf-param', 'custom_authenticity_token'
+      assert_select 'meta[name=?]', 'csrf-token'
+      assert_match(/cf50faa3fe97702ca1ae&lt;=\?/, @response.body)
+    end
   end
 end
 
@@ -485,30 +492,36 @@ class FreeCookieControllerTest < ActionController::TestCase
   def setup
     @controller = FreeCookieController.new
     @token      = "cf50faa3fe97702ca1ae"
-
-    SecureRandom.stubs(:base64).returns(@token)
     super
   end
 
   def test_should_not_render_form_with_token_tag
-    get :index
-    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    SecureRandom.stub :base64, @token do
+      get :index
+      assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    end
   end
 
   def test_should_not_render_button_to_with_token_tag
-    get :show_button
-    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    SecureRandom.stub :base64, @token do
+      get :show_button
+      assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token, false
+    end
   end
 
   def test_should_allow_all_methods_without_token
-    [:post, :patch, :put, :delete].each do |method|
-      assert_nothing_raised { send(method, :index)}
+    SecureRandom.stub :base64, @token do
+      [:post, :patch, :put, :delete].each do |method|
+        assert_nothing_raised { send(method, :index)}
+      end
     end
   end
 
   test 'should not emit a csrf-token meta tag' do
-    get :meta
-    assert @response.body.blank?
+    SecureRandom.stub :base64, @token do
+      get :meta
+      assert @response.body.blank?
+    end
   end
 end
 
@@ -529,11 +542,11 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
 
   def test_should_not_warn_if_form_authenticity_param_matches_form_authenticity_token
     ActionController::Base.logger = @logger
-    @controller.stubs(:valid_authenticity_token?).returns(:true)
-
     begin
-      post :index, params: { custom_token_name: 'foobar' }
-      assert_equal 0, @logger.logged(:warn).size
+      @controller.stub :valid_authenticity_token?, :true do
+        post :index, params: { custom_token_name: 'foobar' }
+        assert_equal 0, @logger.logged(:warn).size
+      end
     ensure
       ActionController::Base.logger = @old_logger
     end