1 files changed, 84 insertions, 22 deletions

diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index 2a5aad9c0e..88155bb404 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -103,6 +103,31 @@ class RequestForgeryProtectionControllerUsingNullSession < ActionController::Bas
   end
 end
 
+class PrependProtectForgeryBaseController < ActionController::Base
+  before_action :custom_action
+  attr_accessor :called_callbacks
+
+  def index
+    render inline: 'OK'
+  end
+
+  protected
+
+  def add_called_callback(name)
+    @called_callbacks ||= []
+    @called_callbacks << name
+  end
+
+
+  def custom_action
+    add_called_callback("custom_action")
+  end
+
+  def verify_authenticity_token
+    add_called_callback("verify_authenticity_token")
+  end
+end
+
 class FreeCookieController < RequestForgeryProtectionControllerUsingResetSession
   self.allow_forgery_protection = false
 
@@ -125,8 +150,9 @@ end
 module RequestForgeryProtectionTests
   def setup
     @token      = "cf50faa3fe97702ca1ae"
-
-    SecureRandom.stubs(:base64).returns(@token)
+    @controller.stubs(:form_authenticity_token).returns(@token)
+    @controller.stubs(:valid_authenticity_token?).with{ |_, t| t == @token }.returns(true)
+    @controller.stubs(:valid_authenticity_token?).with{ |_, t| t != @token }.returns(false)
     @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
     ActionController::Base.request_forgery_protection_token = :custom_authenticity_token
   end
@@ -236,23 +262,23 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_not_allow_xhr_post_without_token
-    assert_blocked { xhr :post, :index }
+    assert_blocked { post :index, xhr: true }
   end
 
   def test_should_allow_post_with_token
-    assert_not_blocked { post :index, :custom_authenticity_token => @token }
+    assert_not_blocked { post :index, params: { custom_authenticity_token: @token } }
   end
 
   def test_should_allow_patch_with_token
-    assert_not_blocked { patch :index, :custom_authenticity_token => @token }
+    assert_not_blocked { patch :index, params: { custom_authenticity_token: @token } }
   end
 
   def test_should_allow_put_with_token
-    assert_not_blocked { put :index, :custom_authenticity_token => @token }
+    assert_not_blocked { put :index, params: { custom_authenticity_token: @token } }
   end
 
   def test_should_allow_delete_with_token
-    assert_not_blocked { delete :index, :custom_authenticity_token => @token }
+    assert_not_blocked { delete :index, params: { custom_authenticity_token: @token } }
   end
 
   def test_should_allow_post_with_token_in_header
@@ -314,21 +340,21 @@ module RequestForgeryProtectionTests
       get :negotiate_same_origin
     end
 
-    assert_cross_origin_not_blocked { xhr :get, :same_origin_js }
-    assert_cross_origin_not_blocked { xhr :get, :same_origin_js, format: 'js' }
+    assert_cross_origin_not_blocked { get :same_origin_js, xhr: true }
+    assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: 'js'}
     assert_cross_origin_not_blocked do
       @request.accept = 'text/javascript'
-      xhr :get, :negotiate_same_origin
+      get :negotiate_same_origin, xhr: true
     end
   end
 
   # Allow non-GET requests since GET is all a remote <script> tag can muster.
   def test_should_allow_non_get_js_without_xhr_header
-    assert_cross_origin_not_blocked { post :same_origin_js, custom_authenticity_token: @token }
-    assert_cross_origin_not_blocked { post :same_origin_js, format: 'js', custom_authenticity_token: @token }
+    assert_cross_origin_not_blocked { post :same_origin_js, params: { custom_authenticity_token: @token } }
+    assert_cross_origin_not_blocked { post :same_origin_js, params: { format: 'js', custom_authenticity_token: @token } }
     assert_cross_origin_not_blocked do
       @request.accept = 'text/javascript'
-      post :negotiate_same_origin, custom_authenticity_token: @token
+      post :negotiate_same_origin, params: { custom_authenticity_token: @token}
     end
   end
 
@@ -340,11 +366,11 @@ module RequestForgeryProtectionTests
       get :negotiate_cross_origin
     end
 
-    assert_cross_origin_not_blocked { xhr :get, :cross_origin_js }
-    assert_cross_origin_not_blocked { xhr :get, :cross_origin_js, format: 'js' }
+    assert_cross_origin_not_blocked { get :cross_origin_js, xhr: true }
+    assert_cross_origin_not_blocked { get :cross_origin_js, xhr: true, format: 'js' }
     assert_cross_origin_not_blocked do
       @request.accept = 'text/javascript'
-      xhr :get, :negotiate_cross_origin
+      get :negotiate_cross_origin, xhr: true
     end
   end
 
@@ -386,10 +412,11 @@ class RequestForgeryProtectionControllerUsingResetSessionTest < ActionController
   end
 
   test 'should emit a csrf-param meta tag and a csrf-token meta tag' do
-    SecureRandom.stubs(:base64).returns(@token + '<=?')
+    @controller.stubs(:form_authenticity_token).returns(@token + '<=?')
     get :meta
     assert_select 'meta[name=?][content=?]', 'csrf-param', 'custom_authenticity_token'
-    assert_select 'meta[name=?][content=?]', 'csrf-token', 'cf50faa3fe97702ca1ae&lt;=?'
+    assert_select 'meta[name=?]', 'csrf-token'
+    assert_match(/cf50faa3fe97702ca1ae&lt;=\?/, @response.body)
   end
 end
 
@@ -429,6 +456,41 @@ class RequestForgeryProtectionControllerUsingExceptionTest < ActionController::T
   end
 end
 
+class PrependProtectForgeryBaseControllerTest < ActionController::TestCase
+  PrependTrueController = Class.new(PrependProtectForgeryBaseController) do
+    protect_from_forgery prepend: true
+  end
+
+  PrependFalseController = Class.new(PrependProtectForgeryBaseController) do
+    protect_from_forgery prepend: false
+  end
+
+  PrependDefaultController = Class.new(PrependProtectForgeryBaseController) do
+    protect_from_forgery
+  end
+
+  def test_verify_authenticity_token_is_prepended
+    @controller = PrependTrueController.new
+    get :index
+    expected_callback_order = ["verify_authenticity_token", "custom_action"]
+    assert_equal(expected_callback_order, @controller.called_callbacks)
+  end
+
+  def test_verify_authenticity_token_is_not_prepended
+    @controller = PrependFalseController.new
+    get :index
+    expected_callback_order = ["custom_action", "verify_authenticity_token"]
+    assert_equal(expected_callback_order, @controller.called_callbacks)
+  end
+
+  def test_verify_authenticity_token_is_prepended_by_default
+    @controller = PrependDefaultController.new
+    get :index
+    expected_callback_order = ["verify_authenticity_token", "custom_action"]
+    assert_equal(expected_callback_order, @controller.called_callbacks)
+  end
+end
+
 class FreeCookieControllerTest < ActionController::TestCase
   def setup
     @controller = FreeCookieController.new
@@ -466,7 +528,7 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
     super
     @old_logger = ActionController::Base.logger
     @logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new
-    @token = "foobar"
+    @token = Base64.strict_encode64(SecureRandom.random_bytes(32))
     @old_request_forgery_protection_token = ActionController::Base.request_forgery_protection_token
     ActionController::Base.request_forgery_protection_token = @token
   end
@@ -478,10 +540,10 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
 
   def test_should_not_warn_if_form_authenticity_param_matches_form_authenticity_token
     ActionController::Base.logger = @logger
-    SecureRandom.stubs(:base64).returns(@token)
+    @controller.stubs(:valid_authenticity_token?).returns(:true)
 
     begin
-      post :index, :custom_token_name => 'foobar'
+      post :index, params: { custom_token_name: 'foobar' }
       assert_equal 0, @logger.logged(:warn).size
     ensure
       ActionController::Base.logger = @old_logger
@@ -492,7 +554,7 @@ class CustomAuthenticityParamControllerTest < ActionController::TestCase
     ActionController::Base.logger = @logger
 
     begin
-      post :index, :custom_token_name => 'bazqux'
+      post :index, params: { custom_token_name: 'bazqux' }
       assert_equal 1, @logger.logged(:warn).size
     ensure
       ActionController::Base.logger = @old_logger