Attachment 1131943 Details for Bug 1310054 – Upstream patch 4.2

[patch] Upstream patch 4.2

4-2-secure_inline_with_params.patch (text/plain), 3.61 KB, created by Adam Mariš on 2016-03-01 13:54:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Mariš

Created: 2016-03-01 13:54:58 UTC

Size: 3.61 KB

patch

obsolete

>From f8e2fe8810d67adfcef8acd95b0e51a31de16acd Mon Sep 17 00:00:00 2001
>From: Arthur Neves <arthurnn@gmail.com>
>Date: Wed, 24 Feb 2016 20:29:10 -0500
>Subject: [PATCH] Don't allow render(params) on views.
>
>If `render(params)` is called in a view it should be protected the same
> way it is in the controllers. We should raise an error if thats happens.
>
>Fix CVE-2016-2098.
>---
> actionpack/test/controller/render_test.rb       | 24 +++++++++++++++++++++++-
> actionview/lib/action_view/renderer/renderer.rb |  4 ++++
> actionview/test/template/render_test.rb         | 19 +++++++++++++++++++
> 3 files changed, 46 insertions(+), 1 deletion(-)
>
>diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb
>index a2d87a8..d607405 100644
>--- a/actionpack/test/controller/render_test.rb
>+++ b/actionpack/test/controller/render_test.rb
>@@ -280,6 +280,16 @@ class MetalTestController < ActionController::Metal
>   end
> end
> 
>+class MetalWithoutAVTestController < ActionController::Metal
>+  include AbstractController::Rendering
>+  include ActionController::Rendering
>+  include ActionController::StrongParameters
>+
>+  def dynamic_params_render
>+    render params
>+  end
>+end
>+
> class ExpiresInRenderTest < ActionController::TestCase
>   tests TestController
> 
>@@ -299,9 +309,10 @@ class ExpiresInRenderTest < ActionController::TestCase
>   end
> 
>   def test_dynamic_render_file_hash
>-    assert_raises ArgumentError do
>+    e = assert_raises ArgumentError do
>       get :dynamic_render, { id: { file: '../\\../test/abstract_unit.rb' } }
>     end
>+    assert_equal "render parameters are not permitted", e.message
>   end
> 
>   def test_expires_in_header
>@@ -500,6 +511,17 @@ class MetalRenderTest < ActionController::TestCase
>   end
> end
> 
>+class MetalRenderWithoutAVTest < ActionController::TestCase
>+  tests MetalWithoutAVTestController
>+
>+  def test_dynamic_params_render
>+    e = assert_raises ArgumentError do
>+      get :dynamic_params_render, { inline: '<%= RUBY_VERSION %>' }
>+    end
>+    assert_equal "render parameters are not permitted", e.message
>+  end
>+end
>+
> class HeadRenderTest < ActionController::TestCase
>   tests TestController
> 
>diff --git a/actionview/lib/action_view/renderer/renderer.rb b/actionview/lib/action_view/renderer/renderer.rb
>index 964b183..5ba7b2b 100644
>--- a/actionview/lib/action_view/renderer/renderer.rb
>+++ b/actionview/lib/action_view/renderer/renderer.rb
>@@ -17,6 +17,10 @@ module ActionView
> 
>     # Main render entry point shared by AV and AC.
>     def render(context, options)
>+      if options.respond_to?(:permitted?) && !options.permitted?
>+        raise ArgumentError, "render parameters are not permitted"
>+      end
>+
>       if options.key?(:partial)
>         render_partial(context, options)
>       else
>diff --git a/actionview/test/template/render_test.rb b/actionview/test/template/render_test.rb
>index 6b65bfb..b0af6ea 100644
>--- a/actionview/test/template/render_test.rb
>+++ b/actionview/test/template/render_test.rb
>@@ -148,6 +148,25 @@ module RenderTestCases
>     end
>   end
> 
>+  def test_render_with_strong_parameters
>+    params = { :inline => '<%= RUBY_VERSION %>' }
>+    def params.permitted?
>+      false
>+    end
>+    e = assert_raises ArgumentError do
>+      @view.render(params)
>+    end
>+    assert_equal "render parameters are not permitted", e.message
>+  end
>+
>+  def test_render_with_permitted_strong_parameters
>+    params = { inline: "<%= 'hello' %>" }
>+    def params.permitted?
>+      true
>+    end
>+    assert_equal 'hello', @view.render(params)
>+  end
>+
>   def test_render_partial
>     assert_equal "only partial", @view.render(:partial => "test/partial_only")
>   end
>-- 
>2.5.4 (Apple Git-61)
>

Actions: View | Diff

Attachments on bug 1310054: 1128508 | 1131939 | 1131942 | 1131943