adding test for CVE
Add in missing requires
Merge branch '3-1-later' into 3-1-stable

* 3-1-later:
  adding test for CVE
Only use valid mime type symbols as cache keys

CVE-2013-6414

Conflicts:
	actionpack/lib/action_view/lookup_context.rb
Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415

Previously the values were trusted blindly allowing for potential XSS attacks.
Stop using i18n's built in HTML error handling.

i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans.  Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.

Fixes: CVE-2013-4491

Conflicts:
	actionpack/lib/action_view/helpers/translation_helper.rb

Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
Deep Munge the parameters for GET and POST

The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.

Fixes CVE-2013-6417

Conflicts:
	actionpack/lib/action_dispatch/http/request.rb
Merge pull request #13151 from hone/3-1-stable

Backport Rails 3.2.16 Security Fixes to Rails 3.1.x
Use the reference for the mime type to get the format

Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.

Fixes: CVE-2014-0082
Merge remote-tracking branch 'rails/3-1-stable' into 3-1-ruby21

This commit backports fixes for CVE-2014-0082, CVE-2013-6417, CVE-2013-6415 and
CVE-2013-4491 into '3-1-ruby21' branch.