New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Avoid modifying POST params on env while checking for CSRF token #2

Merged

sikachu merged 1 commit into cookpad:master from kobsy:dup-env

Jun 4, 2019

Contributor

kobsy commented Jun 3, 2019

When env is used to create a request, trying to access the POST parameters causes ActionDispatch::Request to parse them into a hash and reassign them back to env. While parsing is minimal, there is a possibility that it will try to parse and convert times, using the set time zone, which can interfere with later processing of the parameters. A simple way to avoid this is to call env.dup when creating the request.


          Avoided modifying env

08d506c

When `env` is used to create a request, trying to access the POST parameters causes `ActionDispatch::Request` to parse them into a hash and reassign them to `env`. While parsing is minimal, there is a possibility that it will try to [parse and convert times](https://github.com/rails/rails/blob/b9ca94caea2ca6a6cc09abaffaad67b447134079/activesupport/lib/active_support/json/decoding.rb#L22-L30), which is not idempotent. A simple way to avoid this is simply to call `env.dup` when creating the request.

Collaborator

sikachu commented Jun 4, 2019

Nice catch, thank you very much!

sikachu merged commit fc0d864 into cookpad:master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet