Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP

Loading…

Check if variant array contains only symbols #14047

Merged
merged 1 commit into from

2 participants

@strzalek
Collaborator

Improved, more tested and more secure code for variant assignment change from #14043

/cc @carlosantoniodasilva

@strzalek strzalek referenced this pull request
Merged

Variant negotiation #14043

@dhh dhh merged commit 9ec42f9 into rails:master
@strzalek strzalek deleted the strzalek:variants-array-check branch
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Feb 13, 2014
  1. @strzalek
This page is out of date. Refresh to see the latest.
View
4 actionpack/lib/action_dispatch/http/mime_negotiation.rb
@@ -70,10 +70,10 @@ def formats
def variant=(variant)
if variant.is_a?(Symbol)
@variant = [variant]
- elsif variant.is_a?(Array)
+ elsif variant.is_a?(Array) && variant.any? && variant.all?{ |v| v.is_a?(Symbol) }
@variant = variant
else
- raise ArgumentError, "request.variant must be set to a Symbol or Array, not a #{variant.class}. " \
+ raise ArgumentError, "request.variant must be set to a Symbol or an Array of Symbols, not a #{variant.class}. " \
"For security reasons, never directly set the variant to a user-provided value, " \
"like params[:variant].to_sym. Check user-provided value against a whitelist first, " \
"then set the variant: request.variant = :tablet if params[:variant] == 'tablet'"
View
8 actionpack/test/dispatch/request_test.rb
@@ -852,6 +852,14 @@ def url_for(options = {})
request.variant = [:phone, :tablet]
assert_equal [:phone, :tablet], request.variant
+
+ assert_raise ArgumentError do
+ request.variant = [:phone, "tablet"]
+ end
+
+ assert_raise ArgumentError do
+ request.variant = "yolo"
+ end
end
test "setting variant with non symbol value" do
Something went wrong with that request. Please try again.