提交 40758347 编写于 作者: N Nick Sieger

Reset rack.input when the environment is scrubbed for the next request

Before this change, posted parameters would leak across requests. The included
test case failed like so:

      1) Failure:
    TestCaseTest#test_multiple_mixed_method_process_should_scrub_rack_input:
    --- expected
    +++ actual
    @@ -1 +1 @@
    -{"bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}
    +{"foo"=>"an foo", "bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}

An argument could be made that this situation isn't encountered often and that
one should limit the number of requests per test case, but I still think the
parameter leaking is an unexpected side-effect.
上级 7e6996a1
......@@ -620,6 +620,7 @@ def scrub_env!(env)
env.delete_if { |k, v| k =~ /^action_dispatch\.rescue/ }
env.delete 'action_dispatch.request.query_parameters'
env.delete 'action_dispatch.request.request_parameters'
env['rack.input'] = StringIO.new
env
end
......
......@@ -854,6 +854,14 @@ def test_should_detect_if_cookie_is_deleted
assert_nil cookies['foo']
end
def test_multiple_mixed_method_process_should_scrub_rack_input
post :test_params, params: { id: 1, foo: 'an foo' }
assert_equal({"id"=>"1", "foo" => "an foo", "controller"=>"test_case_test/test", "action"=>"test_params"}, ::JSON.parse(@response.body))
get :test_params, params: { bar: 'an bar' }
assert_equal({"bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}, ::JSON.parse(@response.body))
end
%w(controller response request).each do |variable|
%w(get post put delete head process).each do |method|
define_method("test_#{variable}_missing_for_#{method}_raises_error") do
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册