TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Include application/javascript when checking content_type

Browse Source
This commit is contained in:
Gabriel Jaldon 2014-12-10 23:21:01 +08:00 committed by Greg Molnar
parent 17bf62033e
commit d3a2c53955
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
actionpack/lib/action_controller/metal/request_forgery_protection.rb
View File

@ -275,7 +275,7 @@ def marked_for_same_origin_verification? # :doc:
# Check for cross-origin JavaScript responses.
def non_xhr_javascript_response? # :doc:
content_type =~ %r(\Atext/javascript) && !request.xhr?
content_type =~ %r(\A(text|application)/javascript) && !request.xhr?
end
AUTHENTICITY_TOKEN_LENGTH = 32

5
actionpack/test/controller/request_forgery_protection_test.rb
View File

@ -521,6 +521,11 @@ def test_should_only_allow_same_origin_js_get_with_xhr_header
get :negotiate_same_origin
end
assert_cross_origin_blocked do
@request.accept = "application/javascript"
get :negotiate_same_origin
end
assert_cross_origin_not_blocked { get :same_origin_js, xhr: true }
assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: "js" }
assert_cross_origin_not_blocked do