56cdc81c08
In the current router DSL, using the +match+ DSL method will match all verbs for the path to the specified endpoint. In the vast majority of cases, people are currently using +match+ when they actually mean +get+. This introduces security implications. This commit disallows calling +match+ without an HTTP verb constraint by default. To explicitly match all verbs, this commit also adds a :via => :all option to +match+. Closes #5964
45 lines
985 B
Ruby
45 lines
985 B
Ruby
require 'isolation/abstract_unit'
|
|
|
|
module ApplicationTests
|
|
class UrlGenerationTest < ActiveSupport::TestCase
|
|
include ActiveSupport::Testing::Isolation
|
|
|
|
def app
|
|
Rails.application
|
|
end
|
|
|
|
test "it works" do
|
|
boot_rails
|
|
require "rails"
|
|
require "action_controller/railtie"
|
|
|
|
class MyApp < Rails::Application
|
|
config.secret_token = "3b7cd727ee24e8444053437c36cc66c4"
|
|
config.session_store :cookie_store, :key => "_myapp_session"
|
|
config.active_support.deprecation = :log
|
|
end
|
|
|
|
MyApp.initialize!
|
|
|
|
class ::ApplicationController < ActionController::Base
|
|
end
|
|
|
|
class ::OmgController < ::ApplicationController
|
|
def index
|
|
render :text => omg_path
|
|
end
|
|
end
|
|
|
|
MyApp.routes.draw do
|
|
get "/" => "omg#index", :as => :omg
|
|
end
|
|
|
|
require 'rack/test'
|
|
extend Rack::Test::Methods
|
|
|
|
get "/"
|
|
assert_equal "/", last_response.body
|
|
end
|
|
end
|
|
end
|