houdini/spec/cve/cve_2015_3225_spec.rb

16 lines
490 B
Ruby
Raw Normal View History

# License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
require 'rails_helper'
describe Rack::Utils do
describe '.parse_nested_query' do
it "raise an exception if the params are too deep" do
len = Rack::Utils.param_depth_limit
expect { Rack::Utils.parse_nested_query("foo#{"[a]" * len}=bar") }.to raise_error(RangeError)
expect {Rack::Utils.parse_nested_query("foo#{"[a]" * (len - 1)}=bar")}.to_not raise_error
end
end
end