TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge pull request #20440 from repinel/fix-message-verifier-encoding-issue

Browse Source 
Fix the message verifier encoding issue
This commit is contained in:
Matthew Draper 2015-06-16 04:25:02 +09:30
commit c5152dd803
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
activesupport/lib/active_support/message_verifier.rb
View File

@ -44,7 +44,7 @@ def initialize(secret, options = {})
# tampered_message = signed_message.chop # editing the message invalidates the signature
# verifier.valid_message?(tampered_message) # => false
def valid_message?(signed_message)
return if signed_message.blank?
return if signed_message.nil? || !signed_message.valid_encoding? || signed_message.blank?
data, digest = signed_message.split("--")
data.present? && digest.present? && ActiveSupport::SecurityUtils.secure_compare(digest, generate_digest(data))

1
activesupport/test/message_verifier_test.rb
View File

@ -24,6 +24,7 @@ def test_valid_message
data, hash = @verifier.generate(@data).split("--")
assert !@verifier.valid_message?(nil)
assert !@verifier.valid_message?("")
assert !@verifier.valid_message?("\xff") # invalid encoding
assert !@verifier.valid_message?("#{data.reverse}--#{hash}")
assert !@verifier.valid_message?("#{data}--#{hash.reverse}")
assert !@verifier.valid_message?("purejunk")