Skip to content

Commit

Permalink
Return self when calling #each, #each_pair, and #each_value instead o…
Browse files Browse the repository at this point in the history
…f the raw @parameters hash

[CVE-2020-8164]
  • Loading branch information
JackMc authored and tenderlove committed May 15, 2020
1 parent e8df564 commit 7a3ee4f
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 0 deletions.
2 changes: 2 additions & 0 deletions actionpack/lib/action_controller/metal/strong_parameters.rb
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,8 @@ def each_pair(&block)
@parameters.each_pair do |key, value|
yield [key, convert_hashes_to_parameters(key, value)]
end

self
end
alias_method :each, :each_pair

Expand Down
8 changes: 8 additions & 0 deletions actionpack/test/controller/parameters/accessors_test.rb
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,14 @@ class ParametersAccessorsTest < ActiveSupport::TestCase
)
end

test "each returns self" do
assert_same @params, @params.each { |_| _ }
end

test "each_pair returns self" do
assert_same @params, @params.each_pair { |_| _ }
end

test "[] retains permitted status" do
@params.permit!
assert_predicate @params[:person], :permitted?
Expand Down

0 comments on commit 7a3ee4f

Please sign in to comment.