spec/initializers/rack_VULNDB-255039_patch_spec.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe 'Rack VULNDB-255039' do
  context 'when handling query params in GET requests' do
    it 'does not treat semicolons as query delimiters' do
      env = ::Rack::MockRequest.env_for('http://gitlab.com?a=b;c=1')

      query_hash = ::Rack::Request.new(env).GET

      # Prior to this patch, this was splitting around the semicolon, which
      # would return {"a"=>"b", "c"=>"1"}
      expect(query_hash).to eq({ "a" => "b;c=1" })
    end
  end
end