Permalink
Browse files

adding test for CVE

  • Loading branch information...
1 parent 647afdb commit b0bf30c194d792191a86f9da1f78b062adb0523e @tenderlove tenderlove committed Feb 10, 2013
Showing with 10 additions and 0 deletions.
  1. +10 −0 activerecord/test/cases/mass_assignment_security_test.rb
View
10 activerecord/test/cases/mass_assignment_security_test.rb
@@ -287,6 +287,16 @@ def test_find_or_create_by_with_admin_role_with_attr_protected_attributes
assert_admin_attributes(p, true)
end
+ def test_attr_protected_with_newline
+ p = LoosePerson.new
+ assert_raises(ActiveRecord::UnknownAttributeError) do
+ p.attributes = {"comments=\n"=>"hax"}
+ end
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ p.attributes= {"comments(1)\n" => "hax"}
+ assert_nil p.comments, "Comments is meant to be attr_protected but I assigned it with attributes="
+ end
+
end

0 comments on commit b0bf30c

Please sign in to comment.