From 2e3c3a87d81e16a2fed442c1cf31360f75737a83 Mon Sep 17 00:00:00 2001
From: Aaron Patterson <aaron.patterson@gmail.com>
Date: Sat, 30 Nov 2013 17:02:53 -0800
Subject: Only use valid mime type symbols as cache keys

CVE-2013-6414
---
 actionview/lib/action_view/lookup_context.rb | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'actionview')

diff --git a/actionview/lib/action_view/lookup_context.rb b/actionview/lib/action_view/lookup_context.rb
index f9d5b97fe3..c6ff683827 100644
--- a/actionview/lib/action_view/lookup_context.rb
+++ b/actionview/lib/action_view/lookup_context.rb
@@ -62,6 +62,13 @@ module ActionView
       @details_keys = ThreadSafe::Cache.new
 
       def self.get(details)
+        if details[:formats]
+          details = details.dup
+          syms    = Set.new Mime::SET.symbols
+          details[:formats] = details[:formats].select { |v|
+            syms.include? v
+          }
+        end
         @details_keys[details] ||= new
       end
 
-- 
cgit v1.2.3