TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Do not allow subscribing to Base channel

Browse Source 
Closes #40482

Prior to this commit it was possible to subscribe with
`ActionCable::Channel::Base` as the subscription class. While it doesn't
seem possible to exploit this in away way, it also doesn't seem like
something we need to allow.

This commit swaps [Module#>=][gte] with [Module#>][gt] to prevent
subscribing to a channel when `ActionCable::Channel::Base` is the
subscription class.

[gte]: https://ruby-doc.org/core-2.5.3/Module.html#method-i-3E-3D
[gt]: https://ruby-doc.org/core-2.5.3/Module.html#method-i-3E
This commit is contained in:
Daniel Colson 2020-11-24 22:30:03 -05:00
parent 18187a95dc
commit d092c133c7
No known key found for this signature in database
GPG Key ID: 88A364BBE77B1353
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
actioncable/lib/action_cable/connection/subscriptions.rb
View File

@ -33,7 +33,7 @@ def add(data)
subscription_klass = id_options[:channel].safe_constantize
if subscription_klass && ActionCable::Channel::Base >= subscription_klass
if subscription_klass && ActionCable::Channel::Base > subscription_klass
subscription = subscription_klass.new(connection, id_key, id_options)
subscriptions[id_key] = subscription
subscription.subscribe_to_channel

11
actioncable/test/connection/subscriptions_test.rb
View File

@ -66,6 +66,17 @@ def throw_exception(_data)
end
end
test "subscribe command with Base channel" do
run_in_eventmachine do
setup_connection
identifier = ActiveSupport::JSON.encode(id: 1, channel: "ActionCable::Channel::Base")
@subscriptions.execute_command "command" => "subscribe", "identifier" => identifier
assert_empty @subscriptions.identifiers
end
end
test "unsubscribe command" do
run_in_eventmachine do
setup_connection