Rails Ruby on Rails → 2.3.10

Comments and changes to this ticket

• You flagged this item as spam.
  

  Steve Purcell June 9th, 2010 @ 10:47 AM

  • Tag changed from “2.3.8 actionpack params” to “2.3.8, actionpack, params”
• 

  José Valim June 22nd, 2010 @ 04:12 PM

  Steve, can you reproduce it in Rails test suite? It makes much easier for us to investigate.

• You flagged this item as spam.
  

  Steve Purcell June 22nd, 2010 @ 09:54 PM

  Okay, a patch providing a test case is attached, together with a dump of the original raw request (which came from Chrome on Mac, though the same problem is evident with Safari).

  • 0001-add-test-case-for-ticket-4808-relating-to-parsing-ur.patch 1.2 KB
  • raw-request.txt 4.1 KB

• You flagged this item as spam.
  

  Steve Purcell June 22nd, 2010 @ 09:56 PM

  The problem, incidentally, seems related to the url-encoded quote marks in the string.

• 

  Neeraj Singh June 22nd, 2010 @ 10:20 PM

  previous version of rack used to remove quotes if there is no line break.

  It was recently changed after much debate on rack mailing list. http://github.com/rack/rack/commit/dae12e088592ee69545b5f2f81b87f49...

• You flagged this item as spam.
  

  Steve Purcell June 22nd, 2010 @ 10:30 PM

  Re: the Rack changes -- wow, I'm amazed there was any debate; it seems like removing parts of the submitted text would obviously be a bad idea.

  But is this a Rack issue? Does the code covered by this patched test ask the Rack stack to parse the URL-encoded params? Or is this parsing Rails-specific? It would be odd to test Rack in a Rails test.

  And if so, I have a question: submitting the sample text to the same test app running under Rails 2.3.5 on the same machine did not cause the problem. Does this mean the two Rails versions were picking up different Rack gems (I have 1.2.1, 1.1.0 and 1.0.1 installed)? And if the problem was an old Rack gem, why would the newer Rails version (2.3.8) show this problem?

• 

  Neeraj Singh June 22nd, 2010 @ 11:33 PM

  I did not notice that it was 2.3.x issue. I am not sure if rails 2.3.8 uses rack for parsing params.

  There was another ticket regarding rails edge in which text area having "hello world" will have quotes removed. However "hello \n world" would have quotes preserved. That issue got fixed by that rack commit.

• You flagged this item as spam.
  

  Steve Purcell June 23rd, 2010 @ 08:18 AM

  Rails 2.3.8 indeed appears to require the broken Rack version 1.1.0, whereas 2.3.5 required Rack 1.0.1, so I guess we can assume that this regression is due to the new dependency on a broken Rack.

  That's a pity.

• You flagged this item as spam.
  

  Subba July 16th, 2010 @ 08:33 PM

  • Assigned user set to “Neeraj Singh”
  • Importance changed from “” to “Low”
• 

  Neeraj Singh July 16th, 2010 @ 08:38 PM

  • Assigned user changed from “Neeraj Singh” to “Jeremy Kemper”

  I am not sure if rails 2.3.9 will use the upgraded version of Rack. If it does then this problem will be solved.

• You flagged this item as spam.
  

  Steve Purcell July 16th, 2010 @ 08:54 PM

  Yeah, I hope so -- as it stands, I've already decided that 2.3.8 isn't safe for production use, since certain user input will get silently truncated, and there's no workaround. Shame that Rails should be compromised by this silly Rack issue.

• You flagged this item as spam.
  

  andreas July 27th, 2010 @ 08:42 PM

  • Tag changed from “2.3.8, actionpack, params” to “2.3.8, 2.3.9, actionpack, params”

  Can we please get Rails 2.3.9 to use the fixed Rack version?

• 

  Jeremy Kemper August 30th, 2010 @ 05:35 AM

  • Milestone set to “2.3.10”
  • State changed from “new” to “incomplete”

  Pending patch and test.

• You flagged this item as spam.
  

  tvdeyen September 1st, 2010 @ 12:40 PM

  +1 from me. Have to go back to 2.3.5 for my App now. Then quotes are submitted correctly.

• You flagged this item as spam.
  

  Steve Purcell September 7th, 2010 @ 11:14 AM

  Confirmed still present in 2.3.9.

  I had a go at bumping the Rack version to 1.2.1, but a whole bunch of tests break then.

• You flagged this item as spam.
  

  Phil Ross September 7th, 2010 @ 10:46 PM

  I've been using the attached initializer to fix this issue with Rails 2.3.8 and 2.3.9. It replaces the parse_query and normalize_params methods in Rack::Utils with fixed versions (the code is from Rack 1.1.0 with the patch from http://github.com/rack/rack/commit/dae12e088592ee69545b5f2f81b87f49... applied).

  • fix_rack_110_quote_parsing.rb 2.3 KB

• You flagged this item as spam.
  

  Steve Purcell September 8th, 2010 @ 09:54 AM

  Terrific - thanks Phil.

• You flagged this item as spam.
  

  caseyf November 18th, 2010 @ 02:59 AM

  Ouch.

  Phil's initializer helped me. Thanks Phil.

• You flagged this item as spam.
  

  Roel van der Hoorn December 13th, 2010 @ 09:41 PM

  +1

  Nasty bug. Patch works well for me (Rails 2.3.10).

• You flagged this item as spam.
  

  Roel van der Hoorn December 22nd, 2010 @ 12:40 PM

  For those who also ran into this bug: http://groups.google.com/group/rack-devel/browse_thread/thread/5876... you may want to use the attached updated patch, which applies the following two commits:

  http://github.com/rack/rack/commit/c028a23b36debbce1005347d4234fe6e...
  http://github.com/rack/rack/commit/55cbbc91ae0a03445dd9e0ba1830f70f...

  • fix_rack_110_quote_parsing_and_cookie_headers.rb 4.3 KB