Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fail to check CSRF at Rails4.2 #2824

Closed
yousuketto opened this issue Apr 13, 2015 · 1 comment
Closed

fail to check CSRF at Rails4.2 #2824

yousuketto opened this issue Apr 13, 2015 · 1 comment
Milestone
Invalid or Duplicate

Comments

@yousuketto
Copy link
Contributor

I use jruby 1.7.19.
I failed to check CSRF at Rails4.2 by raised TypeError [can't convert nil into Integer].
https://github.com/rails/rails/blob/v4.2.1/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L321

Simple reproduction code

# example.rb
ths = []
s1 = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
s2 = "YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY"
10_000.times do
  t = Thread.new do
    number_ary = []
    begin
      s1.bytes.zip(s2.bytes).map { |(c1,c2)| number_ary << [c1 , c2]; c1 ^ c2 }
    rescue Exception
      print "#{$!.inspect}\n#{number_ary.inspect}\n"
    end
  end
  ths << t
end

ths.each(&:join)

result

C:\workspace\sandbox\ruby-byte>jruby example.rb
#<TypeError: can't convert nil into Integer>
[[88, 89], [88, nil]]
#<TypeError: can't convert nil into Integer>
[[88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, nil]]
@yousuketto
Copy link
Contributor Author

Sorry, I was not looking.
Maybe, this is the same isuee as #2577.

@enebo enebo added this to the Invalid or Duplicate milestone Apr 28, 2015
@jmalves jmalves mentioned this issue Dec 7, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
Invalid or Duplicate
Development

No branches or pull requests
2 participants
@enebo @yousuketto