kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Escape HTML entities in JSON keys

Browse source 
Fixes CVE-2015-3226
This commit is contained in:
Rafael Mendonça França 2015-06-15 15:23:01 -03:00
parent af01f45f06
commit 193b76cbf0
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
activesupport/lib/active_support/json/encoding.rb
View file

@ -57,6 +57,10 @@ module ActiveSupport
super.gsub ESCAPE_REGEX_WITHOUT_HTML_ENTITIES, ESCAPED_CHARS
end
end
def to_s
self
end
end
# Mark these as private so we don't leak encoding-specific constructs

7
activesupport/test/json/encoding_test.rb
View file

@ -147,6 +147,13 @@ class TestJSONEncoding < ActiveSupport::TestCase
assert_equal %({\"a\":\"b\",\"c\":\"d\"}), sorted_json(ActiveSupport::JSON.encode(:a => :b, :c => :d))
end
def test_hash_keys_encoding
ActiveSupport.escape_html_entities_in_json = true
assert_equal "{\"\\u003c\\u003e\":\"\\u003c\\u003e\"}", ActiveSupport::JSON.encode("<>" => "<>")
ensure
ActiveSupport.escape_html_entities_in_json = false
end
def test_utf8_string_encoded_properly
result = ActiveSupport::JSON.encode('€2.99')
assert_equal '"€2.99"', result