mem_cache_store_test has flawed test

Unable to run this on a fresh check out.

error: actionpack/lib/action_controller/session/mem_cache_store.rb: does not exist in index
error: actionpack/test/controller/session/mem_cache_store_test.rb: does not exist in index
Patch failed at 0001.
When you have resolved this problem run "git-am --resolved".
If you would prefer to skip this patch, instead run

@Aaron: Correct me if i'm wrong, but if assert_equal nil, cookies['_session_id'] is passing on both cases, it means that the session_id is not affected by sending a param named _session_id and remains as nil... not sure i see the problem or exactly what is so disturbing around here, care to elaborate some more?

-1 on the patch though, applies on 2-3-stable only and not on master, iv'e added a patch for master too.

+1 on Elad's patch. applies and passes here.

+1 verified patch applies and tests pass

Yeah sorry, forgot to say that the patch was for 2-3-stable. The master branch has a new actionpack directory structure... Is there a way to submit a patch for multiple branches? Or should patches always be for master?

@Elad: Ah, so it's just showing that cookie_only is being enforced... kk I get it.

@Elad: Actually, why does assert_equal nil, cookies['session_id'] pass? The test seems like it's trying to show that the session store ignores the URL param :session_id => session_id; however, shouldn't get '/set_session_value' set a cookie regardless of the params you pass in??

I do think the test is broken because it seems that reset! is causing the get '/set_session_value' to not set a cookie... See these examples:

# THIS PASSES:
def test_prevents_session_fixation
  with_test_route_set do
    reset!
    get '/set_session_value'
    assert_response :success
    assert_equal nil, cookies['_session_id']
  end
end
# THIS DOESN'T PASS:
def test_prevents_session_fixation
  with_test_route_set do
    get '/set_session_value'
    assert_response :success
    assert_equal nil, cookies['_session_id']
  end
end

So I just took another look at this.

def test_prevents_session_fixation
  with_test_route_set do
    get '/get_session_value'
    assert_response :success
    assert_equal 'foo: nil', response.body
    session_id = cookies['_session_id']

    reset!

    get '/set_session_value', :_session_id => session_id
    assert_response :success
    assert_not_equal session_id, cookies['_session_id']
  end
end

Basically, Rails's session fixation protection is that it doesn't accept a session_id as a parameter (by default -- if you pass the session option cookie_only: false session fixation can be a problem). What I was confused about in this test is the part before reset!, but now I guess it makes sense: it's just generating a "valid" session_id.

Please close this ticket.