|
 |
0865fc |
From 5c656a271a890cca4b3d438cc1fc76ff98011cbe Mon Sep 17 00:00:00 2001
|
|
|
0865fc |
From: Aaron Patterson <aaron.patterson@gmail.com>
|
|
|
0865fc |
Date: Wed, 20 Jan 2016 10:39:19 -0800
|
|
|
0865fc |
Subject: [PATCH] allow :file to be outside rails root, but anything else must
|
|
|
0865fc |
be inside the rails view directory
|
|
|
0865fc |
|
|
|
0865fc |
Conflicts:
|
|
|
0865fc |
actionpack/test/controller/render_test.rb
|
|
|
0865fc |
actionview/lib/action_view/template/resolver.rb
|
|
|
0865fc |
|
|
|
0865fc |
CVE-2016-0752
|
|
|
0865fc |
---
|
|
|
0865fc |
actionpack/lib/abstract_controller/rendering.rb | 8 +++++-
|
|
|
0865fc |
actionpack/test/controller/render_test.rb | 31 ++++++++++++++++++++++
|
|
|
0865fc |
actionview/lib/action_view/lookup_context.rb | 4 +++
|
|
|
0865fc |
actionview/lib/action_view/path_set.rb | 26 +++++++++++++-----
|
|
|
0865fc |
.../lib/action_view/renderer/abstract_renderer.rb | 2 +-
|
|
|
0865fc |
.../lib/action_view/renderer/template_renderer.rb | 2 +-
|
|
|
0865fc |
actionview/lib/action_view/template/resolver.rb | 25 ++++++++++++++---
|
|
|
0865fc |
actionview/lib/action_view/testing/resolvers.rb | 4 +--
|
|
|
0865fc |
actionview/test/template/render_test.rb | 7 +++++
|
|
|
0865fc |
9 files changed, 93 insertions(+), 16 deletions(-)
|
|
|
0865fc |
|
|
|
0865fc |
diff --git a/actionpack/lib/abstract_controller/rendering.rb b/actionpack/lib/abstract_controller/rendering.rb
|
|
|
0865fc |
index 9d10140..e80d97f 100644
|
|
|
0865fc |
--- a/actionpack/lib/abstract_controller/rendering.rb
|
|
|
0865fc |
+++ b/actionpack/lib/abstract_controller/rendering.rb
|
|
|
0865fc |
@@ -77,7 +77,13 @@ module AbstractController
|
|
|
0865fc |
# render "foo/bar" to render :file => "foo/bar".
|
|
|
0865fc |
# :api: plugin
|
|
|
0865fc |
def _normalize_args(action=nil, options={})
|
|
|
0865fc |
- if action.is_a? Hash
|
|
|
0865fc |
+ case action
|
|
|
0865fc |
+ when ActionController::Parameters
|
|
|
0865fc |
+ unless action.permitted?
|
|
|
0865fc |
+ raise ArgumentError, "render parameters are not permitted"
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+ action
|
|
|
0865fc |
+ when Hash
|
|
|
0865fc |
action
|
|
|
0865fc |
else
|
|
|
0865fc |
options
|
|
|
0865fc |
diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb
|
|
|
0865fc |
index 26806fb..17a019e 100644
|
|
|
0865fc |
--- a/actionpack/test/controller/render_test.rb
|
|
|
0865fc |
+++ b/actionpack/test/controller/render_test.rb
|
|
|
0865fc |
@@ -52,6 +52,16 @@ class TestController < ActionController::Base
|
|
|
0865fc |
end
|
|
|
0865fc |
end
|
|
|
0865fc |
|
|
|
0865fc |
+ def dynamic_render
|
|
|
0865fc |
+ render params[:id] # => String, AC:Params
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+
|
|
|
0865fc |
+ def dynamic_render_with_file
|
|
|
0865fc |
+ # This is extremely bad, but should be possible to do.
|
|
|
0865fc |
+ file = params[:id] # => String, AC:Params
|
|
|
0865fc |
+ render file: file
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+
|
|
|
0865fc |
def conditional_hello_with_public_header
|
|
|
0865fc |
if stale?(:last_modified => Time.now.utc.beginning_of_day, :etag => [:foo, 123], :public => true)
|
|
|
0865fc |
render :action => 'hello_world'
|
|
|
0865fc |
@@ -251,6 +261,20 @@ end
|
|
|
0865fc |
class ExpiresInRenderTest < ActionController::TestCase
|
|
|
0865fc |
tests TestController
|
|
|
0865fc |
|
|
|
0865fc |
+ def test_dynamic_render_with_file
|
|
|
0865fc |
+ # This is extremely bad, but should be possible to do.
|
|
|
0865fc |
+ assert File.exist?(File.join(File.dirname(__FILE__), '../../test/abstract_unit.rb'))
|
|
|
0865fc |
+ response = get :dynamic_render_with_file, { id: '../\\../test/abstract_unit.rb' }
|
|
|
0865fc |
+ assert_equal File.read(File.join(File.dirname(__FILE__), '../../test/abstract_unit.rb')),
|
|
|
0865fc |
+ response.body
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+
|
|
|
0865fc |
+ def test_dynamic_render_file_hash
|
|
|
0865fc |
+ assert_raises ArgumentError do
|
|
|
0865fc |
+ get :dynamic_render, { id: { file: '../\\../test/abstract_unit.rb' } }
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+ end
|
|
|
0865fc |
+
|
|
|
0865fc |
def test_expires_in_header
|
|
|
0865fc |
get :conditional_hello_with_expires_in
|
|
|
0865fc |
assert_equal "max-age=60, private", @response.headers["Cache-Control"]
|
|
|
0865fc |
--
|
|
|
0865fc |
2.2.1
|
|
|
0865fc |
|