activerecord-session_store icon indicating copy to clipboard operation
activerecord-session_store copied to clipboard

ArgumentError: string contains null byte when using postgresql and session_id is set to %00

Open yskkin opened this issue 9 years ago • 0 comments

bundle list
Gems included by the bundle:
  * actionmailer (4.2.4)
  * actionpack (4.2.4)
  * actionview (4.2.4)
  * activejob (4.2.4)
  * activemodel (4.2.4)
  * activerecord (4.2.4)
  * activerecord-session_store (1.0.0)
  * activesupport (4.2.4)
  * arel (6.0.3)
  * builder (3.2.2)
  * bundler (1.10.6)
  * concurrent-ruby (1.0.2)
  * erubis (2.7.0)
  * globalid (0.3.6)
  * i18n (0.7.0)
  * json (1.8.3)
  * loofah (2.0.3)
  * mail (2.6.4)
  * mime-types (3.1)
  * mime-types-data (3.2016.0521)
  * mini_portile2 (2.0.0)
  * minitest (5.9.0)
  * multi_json (1.12.1)
  * nokogiri (1.6.7.2)
  * pg (0.18.4)
  * rack (1.6.4)
  * rack-test (0.6.3)
  * rails (4.2.4)
  * rails-deprecated_sanitizer (1.0.3)
  * rails-dom-testing (1.0.7)
  * rails-html-sanitizer (1.0.3)
  * railties (4.2.4)
  * rake (11.1.2)
  * sprockets (3.6.0)
  * sprockets-rails (3.0.4)
  * thor (0.19.1)
  * thread_safe (0.3.5)
  * tzinfo (1.2.2)

config/database.yml

development:
  adapter: postgresql
  database: ****
  encoding: unicode
  template: template0
  pool: 1
  host: localhost
  username: ****

config/initializer/session_store.rb

Rails.application.config.session_store :active_record_store, key: '_session_id'

app/controller/application_controller.rb

  def index
    session[:hoge] = 'foo bar'
  end

With above setting, curl --verbose --cookie '_session_id=%00' http://localhost:3000/ yields 500 Internal Server Error.

SELECT  "sessions".* FROM "sessions" WHERE "sessions"."session_id" = $1  ORDER BY "sessions"."id" ASC LIMIT 1  [["session_id", "\u0000"]]
ArgumentError: string contains null byte: SELECT  "sessions".* FROM "sessions" WHERE "sessions"."session_id" = $1  ORDER BY "sessions"."id" ASC LIMIT 1
Completed 500 Internal Server Error in 1ms (ActiveRecord: 0.2ms)

ArgumentError (string contains null byte):
  app/controllers/application_controller.rb:7:in `index'

yskkin avatar May 23 '16 08:05 yskkin