From 9f38a3fb0c9c71102da283b014503ccad92da581 Mon Sep 17 00:00:00 2001 From: Grey Baker Date: Wed, 13 Jul 2016 18:44:04 +0100 Subject: Check `request.path_parameters` encoding at the point they're set Check for any non-UTF8 characters in path parameters at the point they're set in `env`. Previously they were checked for when used to get a controller class, but this meant routes that went directly to a Rack app, or skipped controller instantiation for some other reason, had to defend against non-UTF8 characters themselves. --- actionpack/test/dispatch/routing_test.rb | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) (limited to 'actionpack/test/dispatch/routing_test.rb') diff --git a/actionpack/test/dispatch/routing_test.rb b/actionpack/test/dispatch/routing_test.rb index d54cdf7247..5298e63fef 100644 --- a/actionpack/test/dispatch/routing_test.rb +++ b/actionpack/test/dispatch/routing_test.rb @@ -4331,15 +4331,16 @@ class TestInvalidUrls < ActionDispatch::IntegrationTest test "invalid UTF-8 encoding returns a 400 Bad Request" do with_routing do |set| - ActiveSupport::Deprecation.silence do - set.draw do - get "/bar/:id", :to => redirect("/foo/show/%{id}") - get "/foo/show(/:id)", :to => "test_invalid_urls/foo#show" + set.draw do + get "/bar/:id", :to => redirect("/foo/show/%{id}") + get "/foo/show(/:id)", :to => "test_invalid_urls/foo#show" - ActiveSupport::Deprecation.silence do - get "/foo(/:action(/:id))", :controller => "test_invalid_urls/foo" - get "/:controller(/:action(/:id))" - end + ok = lambda { |env| [200, { 'Content-Type' => 'text/plain' }, []] } + get '/foobar/:id', to: ok + + ActiveSupport::Deprecation.silence do + get "/foo(/:action(/:id))", :controller => "test_invalid_urls/foo" + get "/:controller(/:action(/:id))" end end @@ -4354,6 +4355,9 @@ class TestInvalidUrls < ActionDispatch::IntegrationTest get "/bar/%E2%EF%BF%BD%A6" assert_response :bad_request + + get "/foobar/%E2%EF%BF%BD%A6" + assert_response :bad_request end end end @@ -4774,7 +4778,9 @@ class TestPathParameters < ActionDispatch::IntegrationTest end end - get ':controller(/:action/(:id))' + ActiveSupport::Deprecation.silence do + get ':controller(/:action/(:id))' + end end end -- cgit v1.2.3