Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Rails5] Fixes for ActionDispatch::Routing::INSECURE_URL_PARAMETERS_MESSAGE #323

Merged
merged 1 commit into from
Aug 28, 2016

Conversation

harryPL
Copy link
Contributor

@harryPL harryPL commented Aug 28, 2016

While migrating my app to Rails 5 I encountered on ActionDispatch::Routing exception. This PR removes the deprecation warnings associated with the merge! method. It also removes the ActionDispatch::Routing exception. The exact message of the exception is "

Attempting to generate a URL from non-sanitized request parameters! An attacker can inject malicious data into the generated URL, such as changing the host. Whitelist and sanitize passed parameters to be secure."

The problem is present due to changes to ActionController::Parameters in Rails 5.

Excerpt from the framework calls

actionpack (5.0.0) lib/action_dispatch/routing/url_for.rb:176:in url_for' /home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/grid_renderer.rb:550:inbase_link_for_filter'
/home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/helpers/wice_grid_view_helpers.rb:471:in grid_html' /home/pfurman/.rvm/gems/ruby-2.3.1@rails5/bundler/gems/wice_grid-f3d6c462af2b/lib/wice/helpers/wice_grid_view_helpers.rb:124:indefine_grid'
actionview (5.0.0) lib/action_view/template.rb:158:in `block in render'

Remove Rails 5.0.0.1 deprecation warnings and fixes the ActionDispatch::Routing exception while rendering the grid.
@coveralls
Copy link

coveralls commented Aug 28, 2016

Coverage Status

Coverage remained the same at 37.512% when pulling 4c35b14 on harryPL:rails3 into f3d6c46 on leikind:rails3.

@leikind leikind merged commit e8a923e into leikind:rails3 Aug 28, 2016
@leikind
Copy link
Owner

leikind commented Aug 28, 2016

👍 thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants