Permalink
Browse files

Instead of overriding html_types, base the verification on browser_ge…

…nerated_types.

Also Deprecate the old unverifiable types.

[#1145 state:committed]
  • Loading branch information...
1 parent 00c46b5 commit f1ad8b48aae3ee26613b3e77bc0056e120096846 @NZKoz NZKoz committed Nov 13, 2008
Showing with 20 additions and 7 deletions.
  1. +17 −4 actionpack/lib/action_controller/mime_type.rb
  2. +3 −3 actionpack/test/controller/mime_type_test.rb
@@ -19,12 +19,21 @@ module Mime
# end
# end
class Type
- @@html_types = Set.new [:html, :url_encoded_form, :multipart_form, :all]
+ @@html_types = Set.new [:html, :all]
cattr_reader :html_types
- # UNUSED, deprecate?
+ # These are the content types which browsers can generate without using ajax, flash, etc
+ # i.e. following a link, getting an image or posting a form. CSRF protection
+ # only needs to protect against these types.
+ @@browser_generated_types = Set.new [:html, :url_encoded_form, :multipart_form]
+ cattr_reader :browser_generated_types
+
+
@@unverifiable_types = Set.new [:text, :json, :csv, :xml, :rss, :atom, :yaml]
- cattr_reader :unverifiable_types
+ def self.unverifiable_types
+ ActiveSupport::Deprecation.warn("unverifiable_types is deprecated and has no effect", caller)
+ @@unverifiable_types
+ end
# A simple helper class used in parsing the accept header
class AcceptItem #:nodoc:
@@ -170,13 +179,17 @@ def ==(mime_type)
# Returns true if Action Pack should check requests using this Mime Type for possible request forgery. See
# ActionController::RequestForgerProtection.
def verify_request?
- html?
+ browser_generated?
end
def html?
@@html_types.include?(to_sym) || @string =~ /html/
end
+ def browser_generated?
+ @@browser_generated_types.include?(to_sym)
+ end
+
private
def method_missing(method, *args)
if method.to_s =~ /(\w+)\?$/
@@ -77,8 +77,8 @@ def test_verifiable_mime_types
all_types.uniq!
# Remove custom Mime::Type instances set in other tests, like Mime::GIF and Mime::IPHONE
all_types.delete_if { |type| !Mime.const_defined?(type.to_s.upcase) }
- verified, unverified = all_types.partition { |type| Mime::Type.html_types.include? type }
- assert verified.each { |type| assert Mime.const_get(type.to_s.upcase).verify_request?, "Mime Type is not verified: #{type.inspect}" }
- assert unverified.each { |type| assert !Mime.const_get(type.to_s.upcase).verify_request?, "Mime Type is verified: #{type.inspect}" }
+ verified, unverified = all_types.partition { |type| Mime::Type.browser_generated_types.include? type }
+ assert verified.each { |type| assert Mime.const_get(type.to_s.upcase).verify_request?, "Verifiable Mime Type is not verified: #{type.inspect}" }
+ assert unverified.each { |type| assert !Mime.const_get(type.to_s.upcase).verify_request?, "Nonverifiable Mime Type is verified: #{type.inspect}" }
end
end

0 comments on commit f1ad8b4

Please sign in to comment.