kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Escape interpolated params when redirecting - fixes #5688

Browse source
This commit is contained in:
Andrew White 2012-04-29 21:09:49 +01:00
parent 978598b6da
commit 958daaa664
2 changed files with 36 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
actionpack/lib/action_dispatch/routing/redirection.rb
View file

@ -1,4 +1,5 @@
require 'action_dispatch/http/request'
require 'rack/utils'
module ActionDispatch
module Routing
@ -96,13 +97,18 @@ module ActionDispatch
path = args.shift
block = lambda { |params, request|
(params.empty? || !path.match(/%\{\w*\}/)) ? path : (path % params)
(params.empty? || !path.match(/%\{\w*\}/)) ? path : (path % escape(params))
} if String === path
block = path if path.respond_to? :call
raise ArgumentError, "redirection argument not supported" unless block
Redirect.new status, block
end
private
def escape(params)
Hash[params.map{ |k,v| [k, Rack::Utils.escape(v)] }]
end
end
end
end

29
actionpack/test/dispatch/routing_test.rb
View file

@ -2452,3 +2452,32 @@ class TestTildeAndMinusPaths < ActionDispatch::IntegrationTest
end
end
class TestRedirectInterpolation < ActionDispatch::IntegrationTest
Routes = ActionDispatch::Routing::RouteSet.new.tap do |app|
app.draw do
ok = lambda { |env| [200, { 'Content-Type' => 'text/plain' }, []] }
get "/foo/:id" => redirect("/foo/bar/%{id}")
get "/foo/bar/:id" => ok
end
end
def app; Routes end
test "redirect escapes interpolated parameters" do
get "/foo/1%3E"
verify_redirect "http://www.example.com/foo/bar/1%3E"
end
private
def verify_redirect(url, status=301)
assert_equal status, @response.status
assert_equal url, @response.headers['Location']
assert_equal expected_redirect_body(url), @response.body
end
def expected_redirect_body(url)
%(<html><body>You are being <a href="#{ERB::Util.h(url)}">redirected</a>.</body></html>)
end
end