TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Changelog for the new purpose metadata and improved tests

Browse Source
This commit is contained in:
Assain 2018-08-13 23:26:26 +05:30
parent f2970a08b5
commit 5fbdfef0a3
2 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
actionpack/CHANGELOG.md
View File

@ -1,3 +1,19 @@
* Purpose metadata for signed/encrypted cookies.
Rails can now thwart attacks that attempt to copy signed/encrypted value
of a cookie and use it as the value of another cookie.
It does so by stashing the cookie-name in the purpose field which is
then signed/encrypted along with the cookie value. Then, on a server-side
read, we verify the cookie-names and discard any attacked cookies.
Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
writes cookies with the new purpose and expiry metadata embedded.
Pull Request: #32937
*Assain Jaleel*
* Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations. * Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations.
`respond_to` can match multiple types and lead to undefined behavior when `respond_to` can match multiple types and lead to undefined behavior when

12
actionpack/test/dispatch/cookies_test.rb
View File

@ -1405,8 +1405,7 @@ def test_read_rails_5_2_stable_encrypted_cookies_if_config_is_false
assert_equal "5-2-Stable Chocolate Cookies", cookies.encrypted[:favorite] assert_equal "5-2-Stable Chocolate Cookies", cookies.encrypted[:favorite]
freeze_time do travel 1001.years do
travel 1001.years
assert_nil cookies.encrypted[:favorite] assert_nil cookies.encrypted[:favorite]
end end
@ -1422,8 +1421,7 @@ def test_read_rails_5_2_stable_signed_cookies_if_config_is_false
assert_equal "5-2-Stable Choco Chip Cookie", cookies.signed[:favorite] assert_equal "5-2-Stable Choco Chip Cookie", cookies.signed[:favorite]
freeze_time do travel 1001.years do
travel 1001.years
assert_nil cookies.signed[:favorite] assert_nil cookies.signed[:favorite]
end end
@ -1439,8 +1437,7 @@ def test_read_rails_5_2_stable_encrypted_cookies_if_use_metadata_config_is_true
assert_equal "5-2-Stable Chocolate Cookies", cookies.encrypted[:favorite] assert_equal "5-2-Stable Chocolate Cookies", cookies.encrypted[:favorite]
freeze_time do travel 1001.years do
travel 1001.years
assert_nil cookies.encrypted[:favorite] assert_nil cookies.encrypted[:favorite]
end end
@ -1456,8 +1453,7 @@ def test_read_rails_5_2_stable_signed_cookies_if_use_metadata_config_is_true
assert_equal "5-2-Stable Choco Chip Cookie", cookies.signed[:favorite] assert_equal "5-2-Stable Choco Chip Cookie", cookies.signed[:favorite]
freeze_time do travel 1001.years do
travel 1001.years
assert_nil cookies.signed[:favorite] assert_nil cookies.signed[:favorite]
end end