Permalink
Browse files

* Do not convert digest auth strings to symbols. CVE-2012-3424

Conflicts:
	actionpack/lib/action_controller/metal/http_authentication.rb
  • Loading branch information...
tenderlove committed Jul 26, 2012
1 parent 90c9ae5 commit fee0bc57385b564b2789d199969ac26409603188
Showing with 2 additions and 2 deletions.
  1. +2 −2 actionpack/lib/action_controller/metal/http_authentication.rb
@@ -229,9 +229,9 @@ def decode_credentials_header(request)
end
def decode_credentials(header)
- Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+ HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
key, value = pair.split('=', 2)
- [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').delete('\'')]
+ [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
end]
end

0 comments on commit fee0bc5

Please sign in to comment.