New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check for a valid encoding before using a public session id #217

Open

HectorMF wants to merge 1 commit into rails:master from HectorMF:master

HectorMF commented Oct 9, 2024

When penetration testing I discovered that if a public session ID contains an invalid byte sequence the following error occurs:

Error during failsafe response: invalid byte sequence in UTF-8
/gems/activerecord-session_store-2.1.0/lib/action_dispatch/session/active_record_store.rb:163:in `private_session_id?'

This causes an internal server error, when it really should just handle it as an invalid id


          Check for invalid byte sequence when testing a session_id

b41469a

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet