kotovalexarian-likes-github
/
rails--rails
mirror of https://github.com/rails/rails.git
1
0
Fork 0
Code Releases Activity

Try only to decode strings 

This approach will avoid us to check for NoMethodError when trying to
decode
This commit is contained in:
Rafael Mendonça França 2015-02-18 19:37:56 -02:00
parent fb876b8a2c
commit d0303d03a9
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
actionpack/lib/action_controller/metal/request_forgery_protection.rb
View File

@ -275,11 +275,13 @@ module ActionController #:nodoc:
# session token. Essentially the inverse of
# +masked_authenticity_token+.
def valid_authenticity_token?(session, encoded_masked_token)
return false if encoded_masked_token.nil? || encoded_masked_token.empty?
if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String)
return false
end
begin
masked_token = Base64.strict_decode64(encoded_masked_token)
rescue ArgumentError, NoMethodError # encoded_masked_token is invalid Base64
rescue ArgumentError # encoded_masked_token is invalid Base64
return false
end