fail to check CSRF at Rails4.2 #2824

yousuketto · 2015-04-13T06:39:25Z

I use jruby 1.7.19.
I failed to check CSRF at Rails4.2 by raised TypeError [can't convert nil into Integer].
https://github.com/rails/rails/blob/v4.2.1/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L321

Simple reproduction code

# example.rb
ths = []
s1 = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
s2 = "YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY"
10_000.times do
  t = Thread.new do
    number_ary = []
    begin
      s1.bytes.zip(s2.bytes).map { |(c1,c2)| number_ary << [c1 , c2]; c1 ^ c2 }
    rescue Exception
      print "#{$!.inspect}\n#{number_ary.inspect}\n"
    end
  end
  ths << t
end

ths.each(&:join)

result

C:\workspace\sandbox\ruby-byte>jruby example.rb
#<TypeError: can't convert nil into Integer>
[[88, 89], [88, nil]]
#<TypeError: can't convert nil into Integer>
[[88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, 89], [88, nil]]

The text was updated successfully, but these errors were encountered:

yousuketto · 2015-04-13T06:59:10Z

Sorry, I was not looking.
Maybe, this is the same isuee as #2577.

yousuketto closed this as completed Apr 13, 2015

enebo added this to the Invalid or Duplicate milestone Apr 28, 2015

jmalves mentioned this issue Dec 7, 2017

ThreadedNexter shutdown can in some situations interrupt a thread executing a different task #4887

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Sponsors

fail to check CSRF at Rails4.2 #2824

fail to check CSRF at Rails4.2 #2824

yousuketto commented Apr 13, 2015

yousuketto commented Apr 13, 2015

fail to check CSRF at Rails4.2 #2824

fail to check CSRF at Rails4.2 #2824

Comments

yousuketto commented Apr 13, 2015

Simple reproduction code

yousuketto commented Apr 13, 2015