From bee3b7f9371d1e2ddcfe6eaff5dcb26c0a248068 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Sat, 30 Nov 2013 17:02:53 -0800 Subject: [PATCH] Only use valid mime type symbols as cache keys CVE-2013-6414 --- actionpack/lib/action_view/lookup_context.rb | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/actionpack/lib/action_view/lookup_context.rb b/actionpack/lib/action_view/lookup_context.rb index 9f617a9..9331d13 100644 --- a/actionpack/lib/action_view/lookup_context.rb +++ b/actionpack/lib/action_view/lookup_context.rb @@ -62,6 +62,13 @@ module ActionView @details_keys = Hash.new def self.get(details) + if details[:formats] + details = details.dup + syms = Set.new Mime::SET.symbols + details[:formats] = details[:formats].select { |v| + syms.include? v + } + end @details_keys[details] ||= new end -- 1.8.4.1