Skip to content

Commit

Permalink
Fix semicolons as separators for GET
Browse files Browse the repository at this point in the history
Fix to use semicolons as separators for GET not for POST
A semicolon ';' should be used as a separator according to a W3.org recommendation
http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2

The following commit was for only POST not for GET, but the test is
written for GET, which is kind of a discrepancy.
Do not truncate POST data on `;`, closes #543
71c6911
  • Loading branch information
Nyoho committed Jan 7, 2015
1 parent dfda3a5 commit 6af5f92
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 10 deletions.
8 changes: 4 additions & 4 deletions lib/rack/request.rb
Expand Up @@ -188,7 +188,7 @@ def GET
if @env["rack.request.query_string"] == query_string if @env["rack.request.query_string"] == query_string
@env["rack.request.query_hash"] @env["rack.request.query_hash"]
else else
p = parse_query(query_string) p = parse_query(query_string, '&;')
@env["rack.request.query_string"] = query_string @env["rack.request.query_string"] = query_string
@env["rack.request.query_hash"] = p @env["rack.request.query_hash"] = p
end end
Expand All @@ -212,7 +212,7 @@ def POST
form_vars.slice!(-1) if form_vars[-1] == ?\0 form_vars.slice!(-1) if form_vars[-1] == ?\0


@env["rack.request.form_vars"] = form_vars @env["rack.request.form_vars"] = form_vars
@env["rack.request.form_hash"] = parse_query(form_vars) @env["rack.request.form_hash"] = parse_query(form_vars, '&')


@env["rack.input"].rewind @env["rack.input"].rewind
end end
Expand Down Expand Up @@ -365,8 +365,8 @@ def reject_trusted_ip_addresses(ip_addresses)
ip_addresses.reject { |ip| trusted_proxy?(ip) } ip_addresses.reject { |ip| trusted_proxy?(ip) }
end end


def parse_query(qs) def parse_query(qs, d)
Utils.parse_nested_query(qs, '&') Utils.parse_nested_query(qs, d)
end end


def parse_multipart(env) def parse_multipart(env)
Expand Down
23 changes: 17 additions & 6 deletions test/spec_request.rb
Expand Up @@ -134,14 +134,25 @@
req.params.should.equal "foo" => "bar", "quux" => "bla" req.params.should.equal "foo" => "bar", "quux" => "bla"
end end


should "not truncate query strings containing semi-colons #543" do should "not truncate query strings containing semi-colons #543 only in POST" do
req = Rack::Request.new(Rack::MockRequest.env_for("/?foo=bar&quux=b;la")) mr = Rack::MockRequest.env_for("/",
req.query_string.should.equal "foo=bar&quux=b;la" "REQUEST_METHOD" => 'POST',
req.GET.should.equal "foo" => "bar", "quux" => "b;la" :input => "foo=bar&quux=b;la")
req.POST.should.be.empty req = Rack::Request.new mr
req.params.should.equal "foo" => "bar", "quux" => "b;la" req.query_string.should.equal ""
req.GET.should.be.empty
req.POST.should.equal "foo" => "bar", "quux" => "b;la"
req.params.should.equal req.GET.merge(req.POST)
end end


should "use semi-colons as separators for query strings in GET" do
req = Rack::Request.new(Rack::MockRequest.env_for("/?foo=bar&quux=b;la;wun=duh"))
req.query_string.should.equal "foo=bar&quux=b;la;wun=duh"
req.GET.should.equal "foo" => "bar", "quux" => "b", "la" => nil, "wun" => "duh"
req.POST.should.be.empty
req.params.should.equal "foo" => "bar", "quux" => "b", "la" => nil, "wun" => "duh"
end

should "limit the keys from the GET query string" do should "limit the keys from the GET query string" do
env = Rack::MockRequest.env_for("/?foo=bar") env = Rack::MockRequest.env_for("/?foo=bar")


Expand Down

0 comments on commit 6af5f92

Please sign in to comment.