From 6520ea5f7e2215a763ca74bf6cfa87be2347d5df Mon Sep 17 00:00:00 2001
From: Andrew White <andrew.white@unboxedconsulting.com>
Date: Tue, 1 Mar 2016 08:48:53 +0000
Subject: Deprecate :controller and :action path parameters

Allowing :controller and :action values to be specified via the path
in config/routes.rb has been an underlying cause of a number of issues
in Rails that have resulted in security releases. In light of this it's
better that controllers and actions are explicitly whitelisted rather
than trying to blacklist or sanitize 'bad' values.
---
 actionpack/test/controller/integration_test.rb | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

(limited to 'actionpack/test/controller/integration_test.rb')

diff --git a/actionpack/test/controller/integration_test.rb b/actionpack/test/controller/integration_test.rb
index 6277407ff7..ad7166bafa 100644
--- a/actionpack/test/controller/integration_test.rb
+++ b/actionpack/test/controller/integration_test.rb
@@ -730,8 +730,10 @@ class IntegrationProcessTest < ActionDispatch::IntegrationTest
         set.draw do
           get 'moved' => redirect('/method')
 
-          match ':action', :to => controller, :via => [:get, :post], :as => :action
-          get 'get/:action', :to => controller, :as => :get_action
+          ActiveSupport::Deprecation.silence do
+            match ':action', :to => controller, :via => [:get, :post], :as => :action
+            get 'get/:action', :to => controller, :as => :get_action
+          end
         end
 
         self.singleton_class.include(set.url_helpers)
@@ -1105,7 +1107,12 @@ class IntegrationRequestsWithoutSetup < ActionDispatch::IntegrationTest
 
   def test_request
     with_routing do |routes|
-      routes.draw { get ':action' => FooController }
+      routes.draw do
+        ActiveSupport::Deprecation.silence do
+          get ':action' => FooController
+        end
+      end
+
       get '/ok'
 
       assert_response 200
@@ -1173,7 +1180,11 @@ class IntegrationRequestEncodersTest < ActionDispatch::IntegrationTest
 
   def test_parsed_body_without_as_option
     with_routing do |routes|
-      routes.draw { get ':action' => FooController }
+      routes.draw do
+        ActiveSupport::Deprecation.silence do
+          get ':action' => FooController
+        end
+      end
 
       get '/foos_json.json', params: { foo: 'heyo' }
 
@@ -1184,7 +1195,11 @@ class IntegrationRequestEncodersTest < ActionDispatch::IntegrationTest
   private
     def post_to_foos(as:)
       with_routing do |routes|
-        routes.draw { post ':action' => FooController }
+        routes.draw do
+          ActiveSupport::Deprecation.silence do
+            post ':action' => FooController
+          end
+        end
 
         post "/foos_#{as}", params: { foo: 'fighters' }, as: as
 
-- 
cgit v1.2.3