Blame SOURCES/rubygem-actionpack-4.2.7.1-CVE-2016-6317-unsafe-query-tests.patch

0f7aad
diff --git a/actionpack/test/dispatch/request/json_params_parsing_test.rb b/actionpack/test/dispatch/request/json_params_parsing_test.rb
0f7aad
index c609075..e8dec17 100644
0f7aad
--- a/actionpack/test/dispatch/request/json_params_parsing_test.rb
0f7aad
+++ b/actionpack/test/dispatch/request/json_params_parsing_test.rb
0f7aad
@@ -84,7 +84,50 @@ def teardown
0f7aad
     end
0f7aad
   end
0f7aad
 
0f7aad
+  test "prevent null query" do
0f7aad
+    # Make sure we have data to find
0f7aad
+    klass = Class.new(ActiveRecord::Base) do
0f7aad
+      def self.name; 'Foo'; end
0f7aad
+      establish_connection adapter: "sqlite3", database: ":memory:"
0f7aad
+      connection.create_table "foos" do |t|
0f7aad
+        t.string :title
0f7aad
+        t.timestamps null: false
0f7aad
+      end
0f7aad
+    end
0f7aad
+    klass.create
0f7aad
+    assert klass.first
0f7aad
+
0f7aad
+    app = ActionDispatch::ParamsParser.new ->(env) {
0f7aad
+      request = ActionDispatch::Request.new env
0f7aad
+      params = ActionController::Parameters.new request.parameters
0f7aad
+      if params[:t]
0f7aad
+        klass.find_by_title(params[:t])
0f7aad
+      else
0f7aad
+        nil
0f7aad
+      end
0f7aad
+    }
0f7aad
+
0f7aad
+    assert_nil app.call(make_env({ 't' => nil }))
0f7aad
+    assert_nil app.call(make_env({ 't' => [nil] }))
0f7aad
+
0f7aad
+    [[[nil]], [[[nil]]]].each do |data|
0f7aad
+      assert_deprecated do
0f7aad
+        assert_nil app.call(make_env({ 't' => data }))
0f7aad
+      end
0f7aad
+    end
0f7aad
+  end
0f7aad
+
0f7aad
   private
0f7aad
+    def make_env json
0f7aad
+      data = JSON.dump json
0f7aad
+      content_length = data.length
0f7aad
+      {
0f7aad
+        'CONTENT_LENGTH' => content_length,
0f7aad
+        'CONTENT_TYPE'   => 'application/json',
0f7aad
+        'rack.input'     => StringIO.new(data)
0f7aad
+      }
0f7aad
+    end
0f7aad
+
0f7aad
     def assert_parses(expected, actual, headers = {})
0f7aad
       with_test_routing do
0f7aad
         post "/parse", actual, headers