Permalink
Browse files

Merge branch '3-1-later' into 3-1-stable

* 3-1-later:
  adding test for CVE
  • Loading branch information...
2 parents bd34e5c + b0bf30c commit 46c26e84c4b1f74265ff70a5e566fad4658865e0 @tenderlove tenderlove committed Apr 9, 2013
Showing with 10 additions and 0 deletions.
  1. +10 −0 activerecord/test/cases/mass_assignment_security_test.rb
@@ -287,6 +287,16 @@ def test_find_or_create_by_with_admin_role_with_attr_protected_attributes
assert_admin_attributes(p, true)
end
+ def test_attr_protected_with_newline
+ p = LoosePerson.new
+ assert_raises(ActiveRecord::UnknownAttributeError) do
+ p.attributes = {"comments=\n"=>"hax"}
+ end
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ p.attributes= {"comments(1)\n" => "hax"}
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ end
+
end

0 comments on commit 46c26e8

Please sign in to comment.