mirrors
/
rails
mirror of https://github.com/rails/rails
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #23242 from maclover7/fix-error-sec 

Fix undefined error for `ActionController::Parameters`
This commit is contained in:
Aaron Patterson 2016-01-26 17:24:37 -08:00 committed by Rafael Mendonça França
parent fcf0f42494
commit 5ed694e0ce
2 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
actionpack/lib/abstract_controller/rendering.rb
View File

@ -77,13 +77,10 @@ module AbstractController
# render "foo/bar" to render :file => "foo/bar". # render "foo/bar" to render :file => "foo/bar".
# :api: plugin # :api: plugin
def _normalize_args(action=nil, options={}) def _normalize_args(action=nil, options={})
case action if action.respond_to?(:permitted?) && action.permitted?
when ActionController::Parameters raise ArgumentError, "render parameters are not permitted"
unless action.permitted?
raise ArgumentError, "render parameters are not permitted"
end
action action
when Hash elsif action.is_a?(Hash)
action action
else else
options options

6
actionview/test/template/text_helper_test.rb
View File

@ -44,11 +44,11 @@ class TextHelperTest < ActionView::TestCase
end end
def test_simple_format_should_sanitize_input_when_sanitize_option_is_not_false def test_simple_format_should_sanitize_input_when_sanitize_option_is_not_false
assert_equal "<p><b> test with unsafe string </b></p>", simple_format("<b> test with unsafe string </b><script>code!</script>") assert_equal "<p><b> test with unsafe string </b>code!</p>", simple_format("<b> test with unsafe string </b><script>code!</script>")
end end
def test_simple_format_should_sanitize_input_when_sanitize_option_is_true def test_simple_format_should_sanitize_input_when_sanitize_option_is_true
assert_equal '<p><b> test with unsafe string </b></p>', assert_equal '<p><b> test with unsafe string </b>code!</p>',
simple_format('<b> test with unsafe string </b><script>code!</script>', {}, sanitize: true) simple_format('<b> test with unsafe string </b><script>code!</script>', {}, sanitize: true)
end end
@ -193,7 +193,7 @@ class TextHelperTest < ActionView::TestCase
def test_highlight_should_sanitize_input def test_highlight_should_sanitize_input
assert_equal( assert_equal(
"This is a <mark>beautiful</mark> morning", "This is a <mark>beautiful</mark> morningcode!",
highlight("This is a beautiful morning<script>code!</script>", "beautiful") highlight("This is a beautiful morning<script>code!</script>", "beautiful")
) )
end end