mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
82fc62ca71
When parsing HTTP request parameters, Rails delegates to a set of parsing strategies based on the MIME type. If any of these strategies raises an error Rails rescues it and raises an instance of `ActionDispatch::Http::Parameters::ParseError` with the same message as the underlying error. However, in the presence of malformed JSON, the default parameter parser for the `application/json` MIME type raises a `JSON:ParserError` with a message containing the entire malformed JSON string (the request body in this context). By raising a new error with this same message Rails inadvertently ends up logging the full HTTP request body at the `fatal` level. This request body could contain sensitive information or could be intentionally crafted to be extremely large. This commit sets the `ActionDispatch::Http::Parameters::ParseError` message to a static message which mirrors that of the corresponding `debug` log. |
||
|---|---|---|
| .. | ||
| request | ||
| routing | ||
| session | ||
| system_testing | ||
| actionable_exceptions_test.rb | ||
| callbacks_test.rb | ||
| content_disposition_test.rb | ||
| content_security_policy_test.rb | ||
| cookies_test.rb | ||
| debug_exceptions_test.rb | ||
| debug_locks_test.rb | ||
| exception_wrapper_test.rb | ||
| executor_test.rb | ||
| header_test.rb | ||
| host_authorization_test.rb | ||
| live_response_test.rb | ||
| mapper_test.rb | ||
| middleware_stack_test.rb | ||
| mime_type_test.rb | ||
| mount_test.rb | ||
| permissions_policy_test.rb | ||
| prefix_generation_test.rb | ||
| rack_cache_test.rb | ||
| reloader_test.rb | ||
| request_id_test.rb | ||
| request_test.rb | ||
| response_test.rb | ||
| routing_assertions_test.rb | ||
| routing_test.rb | ||
| runner_test.rb | ||
| show_exceptions_test.rb | ||
| ssl_test.rb | ||
| static_test.rb | ||
| test_request_test.rb | ||
| test_response_test.rb | ||
| uploaded_file_test.rb | ||
| url_generation_test.rb | ||