Permalink
Browse files

Merge pull request #13188 from imanel/skip_deep_munge

Add configuration option to optionally disable deep_munge

Conflicts:
	actionpack/CHANGELOG.md
  • Loading branch information...
2 parents 0516841 + e8572cf commit c437a98acaf759d53a85151947709f5efe499a27 @jeremy jeremy committed Dec 20, 2013
View
@@ -1,3 +1,13 @@
+* New config option to opt out of params "deep munging" that was used to
+ address security vulnerability CVE-2013-0155. In your app config:
+
+ config.action_dispatch.perform_deep_munge = false
+
+ Take care to understand the security risk involved before disabling this.
+ [Read more.](https://groups.google.com/forum/#!topic/rubyonrails-security/t1WFuuQyavI)
+
+ *Bernard Potocki*
+
* `rake routes` shows routes defined under assets prefix.
*Ryunosuke SATO*
@@ -16,6 +16,7 @@ class Railtie < Rails::Railtie # :nodoc:
config.action_dispatch.signed_cookie_salt = 'signed cookie'
config.action_dispatch.encrypted_cookie_salt = 'encrypted cookie'
config.action_dispatch.encrypted_signed_cookie_salt = 'signed encrypted cookie'
+ config.action_dispatch.perform_deep_munge = true
config.action_dispatch.default_headers = {
'X-Frame-Options' => 'SAMEORIGIN',
@@ -28,6 +29,7 @@ class Railtie < Rails::Railtie # :nodoc:
initializer "action_dispatch.configure" do |app|
ActionDispatch::Http::URL.tld_length = app.config.action_dispatch.tld_length
ActionDispatch::Request.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
+ ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge
ActionDispatch::Response.default_charset = app.config.action_dispatch.default_charset || app.config.encoding
ActionDispatch::Response.default_headers = app.config.action_dispatch.default_headers
@@ -1,9 +1,15 @@
module ActionDispatch
class Request < Rack::Request
class Utils # :nodoc:
+
+ mattr_accessor :perform_deep_munge
+ self.perform_deep_munge = true
+
class << self
# Remove nils from the params hash
def deep_munge(hash)
+ return hash unless perform_deep_munge
+
hash.each do |k, v|
case v
when Array
@@ -104,6 +104,21 @@ def test_array_parses_without_nil
assert_parses({"action" => ['1']}, "action[]=1&action[]")
end
+ test "perform_deep_munge" do
+ ActionDispatch::Request::Utils.perform_deep_munge = false
+ begin
+ assert_parses({"action" => nil}, "action")
+ assert_parses({"action" => {"foo" => nil}}, "action[foo]")
+ assert_parses({"action" => {"foo" => {"bar" => nil}}}, "action[foo][bar]")
+ assert_parses({"action" => {"foo" => {"bar" => [nil]}}}, "action[foo][bar][]")
+ assert_parses({"action" => {"foo" => [nil]}}, "action[foo][]")
+ assert_parses({"action" => {"foo" => [{"bar" => nil}]}}, "action[foo][][bar]")
+ assert_parses({"action" => ['1',nil]}, "action[]=1&action[]")
+ ensure
+ ActionDispatch::Request::Utils.perform_deep_munge = true
+ end
+ end
+
test "query string with empty key" do
assert_parses(
{ "action" => "create_customer", "full_name" => "David Heinemeier Hansson" },

0 comments on commit c437a98

Please sign in to comment.