Only allow ActionableErrors if show_detailed_exceptions is enabled

[CVE-2020-8185]
rails · Jun 17, 2020 · 661da26 · 661da26
1 parent d2cdf0b
commit 661da26
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/actionpack/lib/action_dispatch/middleware/actionable_exceptions.rb b/actionpack/lib/action_dispatch/middleware/actionable_exceptions.rb
@@ -23,7 +23,7 @@ def call(env)
 
     private
       def actionable_request?(request)
-        request.show_exceptions? && request.post? && request.path == endpoint
+        request.get_header("action_dispatch.show_detailed_exceptions")  && request.post? && request.path == endpoint
       end
 
       def redirect_to(location)

diff --git a/actionpack/test/dispatch/actionable_exceptions_test.rb b/actionpack/test/dispatch/actionable_exceptions_test.rb
@@ -30,7 +30,7 @@ class ActionError < StandardError
       error: ActionError.name,
       action: "Successful action",
       location: "/",
-    }
+    }, headers: { "action_dispatch.show_detailed_exceptions" => true }
 
     assert_equal ["Action!"], Actions
 
@@ -43,7 +43,7 @@ class ActionError < StandardError
       error: ActionError.name,
       action: "Successful action",
       location: "/",
-    }, headers: { "action_dispatch.show_exceptions" => false }
+    }, headers: { "action_dispatch.show_detailed_exceptions" => false }
 
     assert_empty Actions
   end
@@ -54,7 +54,7 @@ class ActionError < StandardError
         error: ActionError.name,
         action: "Failed action",
         location: "/",
-      }
+      }, headers: { "action_dispatch.show_detailed_exceptions" => true }
     end
   end
 
@@ -64,7 +64,7 @@ class ActionError < StandardError
         error: RuntimeError.name,
         action: "Inexistent action",
         location: "/",
-      }
+      }, headers: { "action_dispatch.show_detailed_exceptions" => true }
     end
   end
 
@@ -74,7 +74,7 @@ class ActionError < StandardError
         error: "",
         action: "Inexistent action",
         location: "/",
-      }
+      }, headers: { "action_dispatch.show_detailed_exceptions" => true }
     end
   end
 end