rails--rails/railties/test/json_params_parsing_test.rb

require "abstract_unit"
require "action_dispatch"
require "active_record"

class JsonParamsParsingTest < ActionDispatch::IntegrationTest
  def test_prevent_null_query
    # Make sure we have data to find
    klass = Class.new(ActiveRecord::Base) do
      def self.name; "Foo"; end
      establish_connection adapter: "sqlite3", database: ":memory:"
      connection.create_table "foos" do |t|
        t.string :title
        t.timestamps null: false
      end
    end
    klass.create
    assert klass.first

    app = ->(env) {
      request = ActionDispatch::Request.new env
      params = ActionController::Parameters.new request.parameters
      if params[:t]
        klass.find_by_title(params[:t])
      else
        nil
      end
    }

    assert_nil app.call(make_env("t" => nil))
    assert_nil app.call(make_env("t" => [nil]))

    [[[nil]], [[[nil]]]].each do |data|
      assert_nil app.call(make_env("t" => data))
    end
  ensure
    klass.connection.drop_table("foos")
  end

  private
    def make_env(json)
      data = JSON.dump json
      content_length = data.length
      {
        "CONTENT_LENGTH" => content_length,
        "CONTENT_TYPE"   => "application/json",
        "rack.input"     => StringIO.new(data)
      }
    end
end