Rafael Mendonça França 0f3b7d1a31 Only accept actions without File::SEPARATOR in the name. ...

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130

2014-05-05 11:37:34 -03:00

..

controller_fixtures

New routes implementation. Simpler, faster, easier to understand. The published API for config/routes.rb is unchanged, but nearly everything else is different, so expect breakage in plugins and libs that try to fiddle with routes.

2006-06-01 15:42:08 +00:00

new_base

Only accept actions without File::SEPARATOR in the name.

2014-05-05 11:37:34 -03:00

request

cleaning up some warnings on 1.9.3

2011-02-07 16:44:27 -08:00

action_pack_assertions_test.rb

Backport #5808

2013-03-24 08:16:26 -04:00

addresses_render_test.rb

Fix isolated running of AddressesTest

2009-09-06 21:42:05 -05:00

assert_select_test.rb

Remove the leading \n added by textarea on assert_select

2012-03-30 11:44:15 -03:00

base_test.rb

Merge pull request #9802 from newsline/fix-broken-action-missing

2013-03-20 18:22:31 -03:00

caching_test.rb

Rack body respond to each and not to join

2012-02-14 21:53:38 -02:00

capture_test.rb

Test correct method behaviour.

2010-09-29 12:42:51 -03:00

content_type_test.rb

Fix some warnings on 3-2-stable

2012-02-21 12:43:41 +09:00

default_url_options_with_filter_test.rb

it's -> its

2011-12-15 12:57:33 -08:00

filters_test.rb

Tests only after filters in cache sweepers

2011-06-22 18:00:46 +02:00

flash_hash_test.rb

many args does not make sense with the current implementation because of how use works

2011-04-06 18:13:16 -07:00

flash_test.rb

Add test to flash sweep after two redirects

2012-06-05 16:05:49 -03:00

force_ssl_test.rb

Fixed force_ssl redirects to include original query params

2012-02-06 17:47:17 -05:00

helper_test.rb

Removing extra requires from the test. Already loaded in abstract_unit.

2011-07-31 23:36:21 +05:30

http_basic_authentication_test.rb

deprecate ActiveSupport::Base64

2012-01-03 00:57:03 +03:00

http_digest_authentication_test.rb

Fix http digest authentication with trailing '/' or '?' (fixes #4038 and #3228)

2012-01-10 04:42:46 +01:00

http_token_authentication_test.rb

Deletes trailing whitespaces (over text files only find * -type f -exec sed 's/[ \t]*$//' -i {} \;)

2010-08-14 04:12:33 -03:00

integration_test.rb

Include routes.mounted_helpers into integration tests

2012-06-01 16:28:43 +02:00

layout_test.rb

Do not run this streaming test in Ruby 1.8, fix syntax error

2013-01-17 10:27:38 -02:00

localized_templates_test.rb

Extract hardcoded lists to Redo::RestaurantsList

2013-03-14 18:02:20 -03:00

log_subscriber_test.rb

log 404 status when ActiveRecord::RecordNotFound was raised (#7646)

2012-09-17 13:39:01 -03:00

mime_responds_test.rb

Add test case for #5307

2012-03-07 15:03:19 +01:00

output_escaping_test.rb

code gardening: we have assert_(nil|blank|present), more concise, with better default failure messages - let's use them

2010-08-17 03:32:11 +02:00

params_wrapper_test.rb

Show in log correct wrapped keys

2012-07-05 15:47:04 +04:00

record_identifier_test.rb

moving fake model to the correct file

2010-10-03 14:40:06 -07:00

redirect_test.rb

Merge pull request #5457 from brianmario/typo-fix

2012-03-15 15:22:46 -07:00

render_js_test.rb

removes support for render :update

2011-04-13 13:23:17 +02:00

render_json_test.rb

Revert the serializers API as other alternatives are now also under discussion

2011-11-25 19:29:39 +00:00

render_other_test.rb

removes support for render :update

2011-04-13 13:23:17 +02:00

render_test.rb

backport #4f0f1b5 into 3-2-stable. because 1.9.3-p362 warned unused variables.

2013-01-05 09:38:23 +09:00

render_xml_test.rb

Removed deprecated RouteSet API, still many tests fail

2010-09-05 13:44:36 +02:00

request_forgery_protection_test.rb

Cover one more case in auth_token and remote forms

2012-03-28 18:09:53 +02:00

rescue_test.rb

removing more duplicate code

2010-10-01 18:05:59 -07:00

resources_test.rb

all routes can be stored in the Journey Routes object

2011-09-12 16:50:48 -07:00

routing_test.rb

Use Ruby 1.8 syntax

2013-01-02 22:52:59 -03:00

runner_test.rb

adding a test for the runner module [#6027 state:resolved]

2010-11-22 15:57:03 -08:00

selector_test.rb

Rename duplicated test name.

2010-09-27 11:19:24 -03:00

send_file_test.rb

Accept symbols as #send_data :disposition value

2012-11-27 00:25:55 +01:00

show_exceptions_test.rb

Show detailed exceptions no longer returns true if the request is local in production.

2011-12-16 10:45:59 +01:00

test_test.rb

Since File instance doesn't respond to #open use a double to test the

2012-09-30 22:59:23 -03:00

url_for_integration_test.rb

fix method redefined warnings in tests

2011-11-30 18:57:12 +03:00

url_for_test.rb

Fix url_for options[:subdomain] to allow objects as values

2011-12-14 22:43:42 +08:00

url_rewriter_test.rb

/ is allowed in URI fragments

2011-10-13 21:41:30 -07:00

view_paths_test.rb

Add some deprecations for logic being removed in 4.0

2012-01-17 18:07:08 -02:00

webservice_test.rb

CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.

2013-01-08 11:09:50 -08:00