1. 22 9月, 2020 1 次提交
    • A
      Catch invalid UTF-8 encodings on ActionDispatch::Http::Request#POST (#40124) · 7dc53ec9
      Adrianna Chang 提交于
      * Add binary encoding logic into ActionDispatch::Request::Utils
      
      Moving the logic to set binary encoding into ActionDispatch::Request::Utils
      will allow us to encode from GET and POST in ActionDispatch::Request.
      
      * Refactor binary encoding logic
      
      - Move binary encoding calls into GET, POST and path_parameters
      - Remove binary encoding from ActionDispatch::Http::Request
      - This way, we only raise an invalid encoding exception if the controller is not requesting
      parameters in binary encoding
      
      * Check if encoding is valid in ActionDispatch::Request#POST and raise BadRequest if invalid
      
      * Fix multipart_params_test that has binary-encoded params containing invalid UTF-8 characters
      
      * Address PR comments
      
      * Pass action and controller to Request::Utils.set_binary_encoding
      
      [Rafael Mendonça França + Adrianna Chang]
      7dc53ec9
  2. 29 7月, 2017 1 次提交
  3. 02 7月, 2017 1 次提交
  4. 01 7月, 2017 1 次提交
  5. 23 5月, 2017 1 次提交
  6. 25 12月, 2016 1 次提交
  7. 25 10月, 2016 1 次提交
  8. 16 8月, 2016 1 次提交
  9. 07 8月, 2016 2 次提交
  10. 01 3月, 2016 1 次提交
    • A
      Deprecate :controller and :action path parameters · 6520ea5f
      Andrew White 提交于
      Allowing :controller and :action values to be specified via the path
      in config/routes.rb has been an underlying cause of a number of issues
      in Rails that have resulted in security releases. In light of this it's
      better that controllers and actions are explicitly whitelisted rather
      than trying to blacklist or sanitize 'bad' values.
      6520ea5f
  11. 04 8月, 2015 1 次提交
  12. 18 7月, 2015 1 次提交
    • P
      Stop using deprecated `render :text` in test · 8cb8ce98
      Prem Sichanugrist 提交于
      This will silence deprecation warnings.
      
      Most of the test can be changed from `render :text` to render `:plain`
      or `render :body` right away. However, there are some tests that needed
      to be fixed by hand as they actually assert the default Content-Type
      returned from `render :body`.
      8cb8ce98
  13. 03 2月, 2015 1 次提交
  14. 29 1月, 2015 2 次提交
  15. 04 6月, 2014 1 次提交
  16. 19 5月, 2014 1 次提交
    • J
      Upgraded rack · adffea62
      Jarmo Isotalo 提交于
      As Rack has some non backwards compatible changes added required
      modifications to keep behaviour in rails close to same as before.
      
      Also modified generators to include rack/rack for not yet released
      version of rack
      adffea62
  17. 29 6月, 2013 1 次提交
  18. 15 3月, 2013 1 次提交
  19. 11 12月, 2012 1 次提交
  20. 25 4月, 2012 1 次提交
    • J
      Remove default match without specified method · 56cdc81c
      Jose and Yehuda 提交于
      In the current router DSL, using the +match+ DSL
      method will match all verbs for the path to the
      specified endpoint.
      
      In the vast majority of cases, people are
      currently using +match+ when they actually mean
      +get+. This introduces security implications.
      
      This commit disallows calling +match+ without
      an HTTP verb constraint by default. To explicitly
      match all verbs, this commit also adds a
      :via => :all option to +match+.
      
      Closes #5964
      56cdc81c
  21. 25 12月, 2011 1 次提交
  22. 03 5月, 2011 1 次提交
  23. 05 10月, 2010 1 次提交
  24. 29 9月, 2010 1 次提交
  25. 26 9月, 2010 1 次提交
  26. 05 9月, 2010 1 次提交
  27. 28 6月, 2010 1 次提交
  28. 09 12月, 2009 1 次提交
  29. 04 10月, 2009 1 次提交
  30. 28 8月, 2009 1 次提交
  31. 03 8月, 2009 1 次提交
    • Y
      Remove legacy processing and content_length · b53f0069
      Yehuda Katz 提交于
        * convert_content_type! is handled by assign_default_content_type_and_charset!
        * set_content_length! should be handled by the endpoint server. Otherwise
          each middleware that modifies the body has to do the expensive work of
          recalculating content_length.
        * convert_language! appears to be legacy. There are no tests for this
        * convert_cookies! should be handled by the new HeaderHash in Rack
        * Use an integer for .status's internal representation to avoid needing to
          do String manipulation just to find out the status
      b53f0069
  32. 28 4月, 2009 1 次提交
  33. 27 4月, 2009 1 次提交
  34. 26 4月, 2009 2 次提交
  35. 18 4月, 2009 2 次提交
  36. 29 1月, 2009 1 次提交