|
From b7d666e95aee11e441908278425d16deef87cefb Mon Sep 17 00:00:00 2001
|
|
From: Aaron Patterson <aaron.patterson@gmail.com>
|
|
Date: Fri, 4 Jan 2013 12:02:22 -0800
|
|
Subject: [PATCH 1/2] * Strip nils from collections on JSON and XML posts.
|
|
[CVE-2013-0155] * dealing with empty hashes. Thanks
|
|
Damien Mathieu
|
|
|
|
---
|
|
actionpack/lib/action_dispatch/http/request.rb | 10 ++++------
|
|
.../lib/action_dispatch/middleware/params_parser.rb | 4 ++--
|
|
2 files changed, 6 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
|
|
index afc0496..dea8e86 100644
|
|
--- a/actionpack/lib/action_dispatch/http/request.rb
|
|
+++ b/actionpack/lib/action_dispatch/http/request.rb
|
|
@@ -247,18 +247,14 @@ module ActionDispatch
|
|
LOCALHOST.any? { |local_ip| local_ip === remote_addr && local_ip === remote_ip }
|
|
end
|
|
|
|
- protected
|
|
-
|
|
# Remove nils from the params hash
|
|
def deep_munge(hash)
|
|
- keys = hash.keys.find_all { |k| hash[k] == [nil] }
|
|
- keys.each { |k| hash[k] = nil }
|
|
-
|
|
- hash.each_value do |v|
|
|
+ hash.each do |k, v|
|
|
case v
|
|
when Array
|
|
v.grep(Hash) { |x| deep_munge(x) }
|
|
v.compact!
|
|
+ hash[k] = nil if v.empty?
|
|
when Hash
|
|
deep_munge(v)
|
|
end
|
|
@@ -267,6 +263,8 @@ module ActionDispatch
|
|
hash
|
|
end
|
|
|
|
+ protected
|
|
+
|
|
def parse_query(qs)
|
|
deep_munge(super)
|
|
end
|
|
diff --git a/actionpack/lib/action_dispatch/middleware/params_parser.rb b/actionpack/lib/action_dispatch/middleware/params_parser.rb
|
|
index 6ded9db..ac72689 100644
|
|
--- a/actionpack/lib/action_dispatch/middleware/params_parser.rb
|
|
+++ b/actionpack/lib/action_dispatch/middleware/params_parser.rb
|
|
@@ -38,13 +38,13 @@ module ActionDispatch
|
|
when Proc
|
|
strategy.call(request.raw_post)
|
|
when :xml_simple, :xml_node
|
|
- data = Hash.from_xml(request.body.read) || {}
|
|
+ data = request.deep_munge(Hash.from_xml(request.body.read) || {})
|
|
request.body.rewind if request.body.respond_to?(:rewind)
|
|
data.with_indifferent_access
|
|
when :yaml
|
|
YAML.load(request.raw_post)
|
|
when :json
|
|
- data = ActiveSupport::JSON.decode(request.body)
|
|
+ data = request.deep_munge ActiveSupport::JSON.decode(request.body)
|
|
request.body.rewind if request.body.respond_to?(:rewind)
|
|
data = {:_json => data} unless data.is_a?(Hash)
|
|
data.with_indifferent_access
|
|
--
|
|
1.7.10.2 (Apple Git-33)
|
|
|
|
|
