kotovalexarian-likes-github
/
rails--rails
mirror of https://github.com/rails/rails.git
1
0
Fork 0
Code Releases Activity
rails--rails/actionpack
History
Aaron Lahey 82fc62ca71
Use static message when raising HTTP request parameter parse errors 
When parsing HTTP request parameters, Rails delegates to a set of parsing
strategies based on the MIME type. If any of these strategies raises an
error Rails rescues it and raises an instance of
`ActionDispatch::Http::Parameters::ParseError` with the same message as
the underlying error.

However, in the presence of malformed JSON, the default parameter parser
for the `application/json` MIME type raises a `JSON:ParserError` with a
message containing the entire malformed JSON string (the request body in
this context). By raising a new error with this same message Rails
inadvertently ends up logging the full HTTP request body at the `fatal`
level. This request body could contain sensitive information or could be
intentionally crafted to be extremely large.

This commit sets the `ActionDispatch::Http::Parameters::ParseError` message
to a static message which mirrors that of the corresponding `debug` log.
 		2021-08-28 11:56:05 -05:00
..
bin
…
lib Use static message when raising HTTP request parameter parse errors 2021-08-28 11:56:05 -05:00
test Use static message when raising HTTP request parameter parse errors 2021-08-28 11:56:05 -05:00
CHANGELOG.md Use static message when raising HTTP request parameter parse errors 2021-08-28 11:56:05 -05:00
MIT-LICENSE Bump license years to 2021 [ci skip] 2021-01-01 12:21:20 +09:00
README.rdoc Update ActionPack documentation to remove views mention 2021-04-22 19:00:45 -07:00
Rakefile
…
actionpack.gemspec Bump rack to remove ssl? override 2021-06-01 11:15:14 -07:00

README.rdoc 

= Action Pack -- From request to response

Action Pack is a framework for handling and responding to web requests. It
provides mechanisms for *routing* (mapping request URLs to actions), defining
*controllers* that implement actions, and generating responses. In short, Action Pack
provides the controller layer in the MVC paradigm.

It consists of several modules:

* Action Dispatch, which parses information about the web request, handles
  routing as defined by the user, and does advanced processing related to HTTP
  such as MIME-type negotiation, decoding parameters in POST, PATCH, or PUT bodies,
  handling HTTP caching logic, cookies and sessions.

* Action Controller, which provides a base controller class that can be
  subclassed to implement filters and actions to handle requests. The result
  of an action is typically content generated from views.

With the Ruby on Rails framework, users only directly interface with the
Action Controller module. Necessary Action Dispatch functionality is activated
by default and Action View rendering is implicitly triggered by Action
Controller. However, these modules are designed to function on their own and
can be used outside of Rails.

You can read more about Action Pack in the {Action Controller Overview}[https://guides.rubyonrails.org/action_controller_overview.html] guide.

== Download and installation

The latest version of Action Pack can be installed with RubyGems:

  $ gem install actionpack

Source code can be downloaded as part of the Rails project on GitHub:

* https://github.com/rails/rails/tree/main/actionpack


== License

Action Pack is released under the MIT license:

* https://opensource.org/licenses/MIT


== Support

API documentation is at:

* https://api.rubyonrails.org

Bug reports for the Ruby on Rails project can be filed here:

* https://github.com/rails/rails/issues

Feature requests should be discussed on the rails-core mailing list here:

* https://discuss.rubyonrails.org/c/rubyonrails-core