diff --git a/test/apps/rails3.1/app/controllers/other_controller.rb b/test/apps/rails3.1/app/controllers/other_controller.rb index 800560205acde2f2f5d6de2e3a128ec4bf043a51..65100ca9b2d667057771f69478969d56898369f5 100644 --- a/test/apps/rails3.1/app/controllers/other_controller.rb +++ b/test/apps/rails3.1/app/controllers/other_controller.rb @@ -36,4 +36,9 @@ class OtherController < ApplicationController @b = params[:badder!] render :test_partial end + + def test_string_interp + @user = User.find(current_user) + @greeting = "Hello, #{greeted += 1; @user.name}!" + end end diff --git a/test/apps/rails3.1/app/views/other/test_string_interp.html.erb b/test/apps/rails3.1/app/views/other/test_string_interp.html.erb new file mode 100644 index 0000000000000000000000000000000000000000..215d57f2178327de4d58c3f945e63fec2fab8673 --- /dev/null +++ b/test/apps/rails3.1/app/views/other/test_string_interp.html.erb @@ -0,0 +1 @@ +<%= raw @greeting %> diff --git a/test/apps/rails3.1/config/routes.rb b/test/apps/rails3.1/config/routes.rb index 8dd8f642d8e108835c85370978d07e505d194457..1509917b303435b32d8b177bdac79e1ab6a2ad28 100644 --- a/test/apps/rails3.1/config/routes.rb +++ b/test/apps/rails3.1/config/routes.rb @@ -15,6 +15,7 @@ Rails31::Application.routes.draw do put 'dee', :to => :d get 'test_partial1' get 'test_partial2' + get 'test_string_interp' end match 'e', :to => 'other#e', :as => 'eeeee' diff --git a/test/tests/test_rails31.rb b/test/tests/test_rails31.rb index 710c3ee4e0e770964a044beca9869d07e3f10d58..ee8e40e675edb01eb91d0b8814c1e9e1c108c8a6 100644 --- a/test/tests/test_rails31.rb +++ b/test/tests/test_rails31.rb @@ -13,7 +13,7 @@ class Rails31Tests < Test::Unit::TestCase def expected @expected ||= { :model => 0, - :template => 14, + :template => 15, :controller => 1, :warning => 48 } end @@ -527,6 +527,15 @@ class Rails31Tests < Test::Unit::TestCase :file => /\/g\.html\.erb/ end + def test_xss_multiple_exp_in_string_interpolation + assert_warning :type => :template, + :warning_type => "Cross Site Scripting", + :line => 1, + :message => /^Unescaped\ model\ attribute/, + :confidence => 0, + :file => /test_string_interp\.html\.erb/ + end + def test_cross_site_scripting_select_tag_CVE_2012_3463 assert_warning :type => :template, :warning_type => "Cross Site Scripting",