Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

Hash#to_params does not perform escaping resulting in invalid query param strings

#5175

The Hash#to_params method does not escape the key and value, which causes the resultant query string to become invalid.

{
  "param-1" => "A string with / characters & that should be ? escaped"
}.to_params # results in param-1=A string with / characters & that should be ? escaped

Reported by Brian Takita · July 21st, 2010 @ 08:01 PM

State: invalid
Milestone: none
Assigned to: Santiago Pastorino Santiago Pastorino
Importance: Low

Activity

  1. Santiago Pastorino
    Santiago Pastorino
    • Assigned user set to Santiago Pastorino
    • Importance changed from to Low

    { "param 1" => "A string with / characters & that should be ? escaped" }.to_param => "param 1=A+string+with+%2F+characters+%26+that+should+be+%3F+escaped"

    So escapes both the keys and the values.
    In which Rails version are you trying?
    i've tested it on master and 2.3.4

    I'm going to upload a test case for this.

    July 21st, 2010 @ 11:20 PM

  2. Repository
    Repository

    July 21st, 2010 @ 11:30 PM

  3. Santiago Pastorino
    Santiago Pastorino
    • State changed from new to invalid

    I will close the ticket if you find something more let me know and i will reopen.

    July 22nd, 2010 @ 01:24 AM

  4. Gaius Centus Novus
    Gaius Centus Novus

    I'm getting this same behavior on Rails 2.3.8 on REE:

    $ ruby --version
ruby 1.8.7 (2010-04-19 patchlevel 253) [i686-darwin10.4.0], MBARI 0x6770, Ruby Enterprise Edition 2010.02

$script/console
Loading development environment (Rails 2.3.8)
DEPRECATION WARNING: require "activerecord" is deprecated and will be removed in Rails 3. Use require "active_record" instead. (called from /Users/jamesrosen/.rvm/gems/ree-1.8.7-2010.02@zendesk/gems/activerecord-2.3.8/lib/activerecord.rb:2)
** [NewRelic] Starting the New Relic Agent.
DEPRECATION WARNING: require "activesupport" is deprecated and will be removed in Rails 3. Use require "active_support" instead. (called from /Users/jamesrosen/.rvm/gems/ree-1.8.7-2010.02@zendesk/gems/activesupport-2.3.8/lib/activesupport.rb:2)
** Erubis 2.6.6
ree-1.8.7-2010.02 > { "param-1" => "A string with / characters & that should be ? escaped" }.to_params
 => "param-1=A string with / characters & that should be ? escaped"

    November 30th, 2010 @ 12:12 AM