Skip to content

Commit 08afa16

Browse files
committed
Fix urlsafe MessageVerifier not to include padding
urlsafe option was introduced to MessageVerifier in 09c3f36 but it can generate strings containing padding character ("=") which is not urlsafe. Fix not to pad when base64 encode.
1 parent 6d8df0a commit 08afa16

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

activesupport/lib/active_support/message_verifier.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ def generate(value, expires_at: nil, expires_in: nil, purpose: nil)
210210

211211
private
212212
def encode(data)
213-
@urlsafe ? Base64.urlsafe_encode64(data) : Base64.strict_encode64(data)
213+
@urlsafe ? Base64.urlsafe_encode64(data, padding: false) : Base64.strict_encode64(data)
214214
end
215215

216216
def decode(data)

activesupport/test/message_verifier_test.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,11 @@ def test_urlsafe
360360
assert_equal message, URI.encode_www_form_component(message)
361361
end
362362

363+
def test_no_padding
364+
message = generate("a")
365+
assert_not_includes message, "="
366+
end
367+
363368
private
364369
def verifier_options
365370
{ urlsafe: true }

0 commit comments

Comments
 (0)