Merge pull request #13188 from imanel/skip_deep_munge

Add configuration option to optionally disable deep_munge

Conflicts:
	actionpack/CHANGELOG.md

actionpack/CHANGELOG.md

@@ -1,3 +1,13 @@
+*   New config option to opt out of params "deep munging" that was used to
+    address security vulnerability CVE-2013-0155. In your app config:
+
+        config.action_dispatch.perform_deep_munge = false
+
+    Take care to understand the security risk involved before disabling this.
+    [Read more.](https://groups.google.com/forum/#!topic/rubyonrails-security/t1WFuuQyavI)
+
+    *Bernard Potocki*
+
 *   `rake routes` shows routes defined under assets prefix.
 
     *Ryunosuke SATO*

actionpack/lib/action_dispatch/railtie.rb

@@ -16,6 +16,7 @@ module ActionDispatch
     config.action_dispatch.signed_cookie_salt = 'signed cookie'
     config.action_dispatch.encrypted_cookie_salt = 'encrypted cookie'
     config.action_dispatch.encrypted_signed_cookie_salt = 'signed encrypted cookie'
+    config.action_dispatch.perform_deep_munge = true
 
     config.action_dispatch.default_headers = {
       'X-Frame-Options' => 'SAMEORIGIN',
@@ -28,6 +29,7 @@ module ActionDispatch
     initializer "action_dispatch.configure" do |app|
       ActionDispatch::Http::URL.tld_length = app.config.action_dispatch.tld_length
       ActionDispatch::Request.ignore_accept_header = app.config.action_dispatch.ignore_accept_header
+      ActionDispatch::Request::Utils.perform_deep_munge = app.config.action_dispatch.perform_deep_munge
       ActionDispatch::Response.default_charset = app.config.action_dispatch.default_charset || app.config.encoding
       ActionDispatch::Response.default_headers = app.config.action_dispatch.default_headers
 

actionpack/lib/action_dispatch/request/utils.rb

@@ -1,9 +1,15 @@
 module ActionDispatch
   class Request < Rack::Request
     class Utils # :nodoc:
+
+      mattr_accessor :perform_deep_munge
+      self.perform_deep_munge = true
+
       class << self
         # Remove nils from the params hash
         def deep_munge(hash)
+          return hash unless perform_deep_munge
+
           hash.each do |k, v|
             case v
             when Array

actionpack/test/dispatch/request/query_string_parsing_test.rb

@@ -104,6 +104,21 @@ class QueryStringParsingTest < ActionDispatch::IntegrationTest
     assert_parses({"action" => ['1']}, "action[]=1&action[]")
   end
 
+  test "perform_deep_munge" do
+    ActionDispatch::Request::Utils.perform_deep_munge = false
+    begin
+      assert_parses({"action" => nil}, "action")
+      assert_parses({"action" => {"foo" => nil}}, "action[foo]")
+      assert_parses({"action" => {"foo" => {"bar" => nil}}}, "action[foo][bar]")
+      assert_parses({"action" => {"foo" => {"bar" => [nil]}}}, "action[foo][bar][]")
+      assert_parses({"action" => {"foo" => [nil]}}, "action[foo][]")
+      assert_parses({"action" => {"foo" => [{"bar" => nil}]}}, "action[foo][][bar]")
+      assert_parses({"action" => ['1',nil]}, "action[]=1&action[]")
+    ensure
+      ActionDispatch::Request::Utils.perform_deep_munge = true
+    end
+  end
+
   test "query string with empty key" do
     assert_parses(
       { "action" => "create_customer", "full_name" => "David Heinemeier Hansson" },