Skip to content
Browse files

* Do not convert digest auth strings to symbols. CVE-2012-3424

  • Loading branch information...
1 parent a4b8a7e commit eb69ad2155e37554c2411b9c11bf70dff1885085 @tenderlove tenderlove committed Jul 26, 2012
Showing with 2 additions and 2 deletions.
  1. +2 −2 actionpack/lib/action_controller/metal/http_authentication.rb
View
4 actionpack/lib/action_controller/metal/http_authentication.rb
@@ -227,9 +227,9 @@ def decode_credentials_header(request)
end
def decode_credentials(header)
- Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+ HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
key, value = pair.split('=', 2)
- [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')]
+ [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
end]
end

0 comments on commit eb69ad2

Please sign in to comment.
Something went wrong with that request. Please try again.