From 407583478ad6d171ae72f81c560bf01c1446117f Mon Sep 17 00:00:00 2001
From: Nick Sieger <nick@nicksieger.com>
Date: Wed, 27 Jul 2016 11:58:55 -0500
Subject: [PATCH 1/2] Reset rack.input when the environment is scrubbed for the
 next request

Before this change, posted parameters would leak across requests. The included
test case failed like so:

      1) Failure:
    TestCaseTest#test_multiple_mixed_method_process_should_scrub_rack_input:
    --- expected
    +++ actual
    @@ -1 +1 @@
    -{"bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}
    +{"foo"=>"an foo", "bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}

An argument could be made that this situation isn't encountered often and that
one should limit the number of requests per test case, but I still think the
parameter leaking is an unexpected side-effect.
---
 actionpack/lib/action_controller/test_case.rb | 1 +
 actionpack/test/controller/test_case_test.rb  | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/actionpack/lib/action_controller/test_case.rb b/actionpack/lib/action_controller/test_case.rb
index b1b3e87934..6c5d7b5e37 100644
--- a/actionpack/lib/action_controller/test_case.rb
+++ b/actionpack/lib/action_controller/test_case.rb
@@ -620,6 +620,7 @@ module ActionController
         env.delete_if { |k, v| k =~ /^action_dispatch\.rescue/ }
         env.delete 'action_dispatch.request.query_parameters'
         env.delete 'action_dispatch.request.request_parameters'
+        env['rack.input'] = StringIO.new
         env
       end
 
diff --git a/actionpack/test/controller/test_case_test.rb b/actionpack/test/controller/test_case_test.rb
index ea59156f65..e288b51716 100644
--- a/actionpack/test/controller/test_case_test.rb
+++ b/actionpack/test/controller/test_case_test.rb
@@ -854,6 +854,14 @@ XML
     assert_nil cookies['foo']
   end
 
+  def test_multiple_mixed_method_process_should_scrub_rack_input
+    post :test_params, params: { id: 1, foo: 'an foo' }
+    assert_equal({"id"=>"1", "foo" => "an foo", "controller"=>"test_case_test/test", "action"=>"test_params"}, ::JSON.parse(@response.body))
+
+    get :test_params, params: { bar: 'an bar' }
+    assert_equal({"bar"=>"an bar", "controller"=>"test_case_test/test", "action"=>"test_params"}, ::JSON.parse(@response.body))
+  end
+
   %w(controller response request).each do |variable|
     %w(get post put delete head process).each do |method|
       define_method("test_#{variable}_missing_for_#{method}_raises_error") do

From 273a691dfd6f77a79ce99f50905024fcdc02e67f Mon Sep 17 00:00:00 2001
From: Nick Sieger <nick@nicksieger.com>
Date: Thu, 28 Jul 2016 14:12:55 -0500
Subject: [PATCH 2/2] Test that ActionDispatch::IntegrationTest does not leak
 parameters

---
 actionpack/test/controller/integration_test.rb | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/actionpack/test/controller/integration_test.rb b/actionpack/test/controller/integration_test.rb
index 3b89531e90..e02b0b267d 100644
--- a/actionpack/test/controller/integration_test.rb
+++ b/actionpack/test/controller/integration_test.rb
@@ -625,6 +625,20 @@ class IntegrationProcessTest < ActionDispatch::IntegrationTest
     end
   end
 
+  def test_post_then_get_with_parameters_do_not_leak_across_requests
+    with_test_route_set do
+      post '/post', params: { leaks: "does-leak?" }
+
+      get '/get_with_params', params: { foo: "bar" }
+
+      assert request.env['rack.input'].string.empty?
+      assert_equal 'foo=bar', request.env["QUERY_STRING"]
+      assert_equal 'foo=bar', request.query_string
+      assert_equal 'bar', request.parameters['foo']
+      assert request.parameters['leaks'].nil?
+    end
+  end
+
   def test_head
     with_test_route_set do
       head '/get'