Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix raw params method to not raise an exception #41280

Merged
merged 1 commit into from Feb 1, 2021
Merged

Fix raw params method to not raise an exception #41280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion actionpack/lib/action_controller/metal/http_authentication.rb
View file
Open in desktop
Expand Up @@ -484,7 +484,7 @@ def rewrite_param_values(array_params)
def raw_params(auth)
_raw_params = auth.sub(TOKEN_REGEX, "").split(/\s*#{AUTHN_PAIR_DELIMITERS}\s*/)

if !_raw_params.first.start_with?(TOKEN_KEY)
if !_raw_params.first&.start_with?(TOKEN_KEY)
_raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}"
end

Expand Down
16 changes: 15 additions & 1 deletion actionpack/test/controller/http_token_authentication_test.rb
View file
Open in desktop
Expand Up @@ -155,7 +155,7 @@ def authenticate_long_credentials
assert_equal(expected, actual)
end

test "token_and_options returns correct token with nounce option" do
test "token_and_options returns correct token with nonce option" do
token = "rcHu+HzSFw89Ypyhn/896A="
nonce_hash = { nonce: "123abc" }
actual = ActionController::HttpAuthentication::Token.token_and_options(sample_request(token, nonce_hash))
Expand All @@ -177,6 +177,20 @@ def authenticate_long_credentials
assert_equal(expected, actual)
end

test "raw_params returns a tuple of key value pair strings when auth does not contain a token key" do
auth = sample_request_without_token_key("rcHu+HzSFw89Ypyhn/896A=").authorization.to_s
actual = ActionController::HttpAuthentication::Token.raw_params(auth)
expected = ["token=rcHu+HzSFw89Ypyhn/896A="]
assert_equal(expected, actual)
end

test "raw_params returns a tuple of key strings when auth does not contain a token key and value" do
auth = sample_request_without_token_key(nil).authorization.to_s
actual = ActionController::HttpAuthentication::Token.raw_params(auth)
expected = ["token="]
assert_equal(expected, actual)
end

test "token_and_options returns right token when token key is not specified in header" do
token = "rcHu+HzSFw89Ypyhn/896A="

Expand Down