Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

This project is archived and is in readonly mode.

Hash#to_params does not perform escaping resulting in invalid query param strings

#5175

The Hash#to_params method does not escape the key and value, which causes the resultant query string to become invalid.

{
  "param-1" => "A string with / characters & that should be ? escaped"
}.to_params # results in param-1=A string with / characters & that should be ? escaped

Reported by Brian Takita · July 21st, 2010 @ 08:01 PM

State: invalid
Milestone: none
Assigned to: Santiago Pastorino Santiago Pastorino
Importance: Low

Activity

  1. Santiago Pastorino
    Santiago Pastorino
    • Assigned user set to Santiago Pastorino
    • Importance changed from to Low

    { "param 1" => "A string with / characters & that should be ? escaped" }.to_param => "param 1=A+string+with+%2F+characters+%26+that+should+be+%3F+escaped"

    So escapes both the keys and the values.
    In which Rails version are you trying?
    i've tested it on master and 2.3.4

    I'm going to upload a test case for this.

    July 21st, 2010 @ 11:20 PM

  2. Repository
    Repository

    July 21st, 2010 @ 11:30 PM

  3. Santiago Pastorino
    Santiago Pastorino
    • State changed from new to invalid

    I will close the ticket if you find something more let me know and i will reopen.

    July 22nd, 2010 @ 01:24 AM

  4. Gaius Centus Novus
    Gaius Centus Novus

    I'm getting this same behavior on Rails 2.3.8 on REE:

    $ ruby --version
ruby 1.8.7 (2010-04-19 patchlevel 253) [i686-darwin10.4.0], MBARI 0x6770, Ruby Enterprise Edition 2010.02

$script/console
Loading development environment (Rails 2.3.8)
DEPRECATION WARNING: require "activerecord" is deprecated and will be removed in Rails 3. Use require "active_record" instead. (called from /Users/jamesrosen/.rvm/gems/ree-1.8.7-2010.02@zendesk/gems/activerecord-2.3.8/lib/activerecord.rb:2)
** [NewRelic] Starting the New Relic Agent.
DEPRECATION WARNING: require "activesupport" is deprecated and will be removed in Rails 3. Use require "active_support" instead. (called from /Users/jamesrosen/.rvm/gems/ree-1.8.7-2010.02@zendesk/gems/activesupport-2.3.8/lib/activesupport.rb:2)
** Erubis 2.6.6
ree-1.8.7-2010.02 > { "param-1" => "A string with / characters & that should be ? escaped" }.to_params
 => "param-1=A string with / characters & that should be ? escaped"

    November 30th, 2010 @ 12:12 AM