This project is archived and is in readonly mode.

ParameterFilter: strings joined into a regexp should be regexp-quoted

#6090

In the following file/line:

https://github.com/rails/rails/blob/master/actionpack/lib/action_di...

The ParameterFilter creates a regexp directly from one or more strings joined together.

If the intention is that we (Rails users, application authors) should specify parameter filters using regexps when we want regexp filters and strings/symbols when we want exact matches and blocks when we want custom behavior, then the strings/symbols being used to construct the regexp should be regexp-quoted.

Rather than:

strings.join('|')

use:

strings.map{|s| Regexp.quote(s)}.join('|')

Reported by y_feldblum (at yahoo) · November 30th, 2010 @ 05:04 PM

Activity

Neeraj Singh
- Importance changed from to Low
Can you submit a patch with test? I guess string should be quoted.

November 30th, 2010 @ 06:25 PM
rails
- State changed from new to open
This issue has been automatically marked as stale because it has not been commented on for at least three months.

The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.

March 1st, 2011 @ 12:00 AM
rails
- State changed from open to stale
March 1st, 2011 @ 12:00 AM