From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sun, 3 Jun 2012 20:08:23 +0000 (+0000)
Subject: Rails CVE-2012-2660.
X-Git-Tag: 1.4.3~2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=70b0d5722b9fddb0fa67372e6d827de94b384944;p=redmine.git

Rails CVE-2012-2660.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.4-stable@9767 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/config/initializers/10-patches.rb b/config/initializers/10-patches.rb
index 959107048..43cd7d0a8 100644
--- a/config/initializers/10-patches.rb
+++ b/config/initializers/10-patches.rb
@@ -85,4 +85,30 @@ module ActionController
       end
     end
   end
+
+  # CVE-2012-2660
+  # https://groups.google.com/group/rubyonrails-security/browse_thread/thread/f1203e3376acec0f
+  class Request
+    protected
+
+    # Remove nils from the params hash
+    def deep_munge(hash)
+      hash.each_value do |v|
+        case v
+        when Array
+          v.grep(Hash) { |x| deep_munge(x) }
+        when Hash
+          deep_munge(v)
+        end
+      end
+
+      keys = hash.keys.find_all { |k| hash[k] == [nil] }
+      keys.each { |k| hash[k] = nil }
+      hash
+    end
+
+    def parse_query(qs)
+      deep_munge(super)
+    end
+  end
 end