Attachment 863440 Details for Bug 1065538 – 3-1-render_text_dos.patch

[patch] 3-1-render_text_dos.patch

3-1-render_text_dos.patch (text/plain), 1.88 KB, created by Kurt Seifried on 2014-02-14 21:42:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2014-02-14 21:42:34 UTC

Size: 1.88 KB

patch

obsolete

>From bd06f51f331cee97aafbd8af9019acec7728556f Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?=
> <rafaelmfranca@gmail.com>
>Date: Tue, 11 Feb 2014 22:56:50 -0200
>Subject: [PATCH] Use the reference for the mime type to get the format
>
>Before we were calling to_sym in the mime type, even when it is unknown
>what can cause denial of service since symbols are not removed by the
>garbage collector.
>---
> actionpack/lib/action_view/template/text.rb |  2 +-
> actionpack/test/template/text_test.rb       | 17 +++++++++++++++++
> 2 files changed, 18 insertions(+), 1 deletion(-)
> create mode 100644 actionpack/test/template/text_test.rb
>
>diff --git a/actionpack/lib/action_view/template/text.rb b/actionpack/lib/action_view/template/text.rb
>index 4261c3b..d90e43b 100644
>--- a/actionpack/lib/action_view/template/text.rb
>+++ b/actionpack/lib/action_view/template/text.rb
>@@ -23,7 +23,7 @@ module ActionView #:nodoc:
>       end
> 
>       def formats
>-        [@mime_type.to_sym]
>+        [@mime_type.respond_to?(:ref) ? @mime_type.ref : @mime_type.to_s]
>       end
>     end
>   end
>diff --git a/actionpack/test/template/text_test.rb b/actionpack/test/template/text_test.rb
>new file mode 100644
>index 0000000..d899d54
>--- /dev/null
>+++ b/actionpack/test/template/text_test.rb
>@@ -0,0 +1,17 @@
>+require 'abstract_unit'
>+
>+class TextTest < ActiveSupport::TestCase
>+  test 'formats returns symbol for recognized MIME type' do
>+    assert_equal [:text], ActionView::Template::Text.new('', :text).formats
>+  end
>+
>+  test 'formats returns string for recognized MIME type when MIME does not have symbol' do
>+    foo = Mime::Type.lookup("foo")
>+    assert_nil foo.to_sym
>+    assert_equal ['foo'], ActionView::Template::Text.new('', foo).formats
>+  end
>+
>+  test 'formats returns string for unknown MIME type' do
>+    assert_equal ['foo'], ActionView::Template::Text.new('', 'foo').formats
>+  end
>+end
>-- 
>1.8.4.3
>

Actions: View | Diff

Attachments on bug 1065538: 863439 | 863440 | 863441