activerecord-session_store
activerecord-session_store copied to clipboard
ArgumentError: string contains null byte when using postgresql and session_id is set to %00
bundle list
Gems included by the bundle:
* actionmailer (4.2.4)
* actionpack (4.2.4)
* actionview (4.2.4)
* activejob (4.2.4)
* activemodel (4.2.4)
* activerecord (4.2.4)
* activerecord-session_store (1.0.0)
* activesupport (4.2.4)
* arel (6.0.3)
* builder (3.2.2)
* bundler (1.10.6)
* concurrent-ruby (1.0.2)
* erubis (2.7.0)
* globalid (0.3.6)
* i18n (0.7.0)
* json (1.8.3)
* loofah (2.0.3)
* mail (2.6.4)
* mime-types (3.1)
* mime-types-data (3.2016.0521)
* mini_portile2 (2.0.0)
* minitest (5.9.0)
* multi_json (1.12.1)
* nokogiri (1.6.7.2)
* pg (0.18.4)
* rack (1.6.4)
* rack-test (0.6.3)
* rails (4.2.4)
* rails-deprecated_sanitizer (1.0.3)
* rails-dom-testing (1.0.7)
* rails-html-sanitizer (1.0.3)
* railties (4.2.4)
* rake (11.1.2)
* sprockets (3.6.0)
* sprockets-rails (3.0.4)
* thor (0.19.1)
* thread_safe (0.3.5)
* tzinfo (1.2.2)
config/database.yml
development:
adapter: postgresql
database: ****
encoding: unicode
template: template0
pool: 1
host: localhost
username: ****
config/initializer/session_store.rb
Rails.application.config.session_store :active_record_store, key: '_session_id'
app/controller/application_controller.rb
def index
session[:hoge] = 'foo bar'
end
With above setting,
curl --verbose --cookie '_session_id=%00' http://localhost:3000/
yields 500 Internal Server Error.
SELECT "sessions".* FROM "sessions" WHERE "sessions"."session_id" = $1 ORDER BY "sessions"."id" ASC LIMIT 1 [["session_id", "\u0000"]]
ArgumentError: string contains null byte: SELECT "sessions".* FROM "sessions" WHERE "sessions"."session_id" = $1 ORDER BY "sessions"."id" ASC LIMIT 1
Completed 500 Internal Server Error in 1ms (ActiveRecord: 0.2ms)
ArgumentError (string contains null byte):
app/controllers/application_controller.rb:7:in `index'