Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #8832 - Parse '{"person":[]}' JSON/XML as {'person' => []}. #9111

Merged
merged 1 commit into from Jan 30, 2013

Conversation

jsomara
Copy link

@jsomara jsomara commented Jan 29, 2013

submitting @ndbroadbent 's patch for the 3.0 stable branch, as the bug introduced by the fix for CVE-2013-0155 applies to 3.0 as well

please see #8862 for details on the issue

if v.size > 0 && v.all?(&:nil?)
hash[k] = nil
next
end

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like your code will convert this JSON:

{"person":[null]}

to this Ruby hash:

{"person": nil}

Is that right?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's right.

After thinking about it some more, I personally think [null] is a valid query, and the problem should be solved with something like .query_present?, that returns false for "", nil, [], [nil], [""], etc.

@steveklabnik
Copy link
Member

3.0 stable does not receive bug fixes any more, so I cannot accept this, sorry.

@tenderlove tenderlove reopened this Jan 30, 2013
tenderlove added a commit that referenced this pull request Jan 30, 2013
Fix #8832 - Parse '{"person":[]}' JSON/XML as {'person' => []}.
@tenderlove tenderlove merged commit 10513d2 into rails:3-0-stable Jan 30, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants