rails/rails — Issue #4292: Bugs introduced by Ruby 1.8.7, patchlevel 357
Author: bkabrda
Created: 2012-01-04 13:53:31+00:00
State: open

Hi, I have tested all the 3.0.11 subprojects (active*, action*) of rails and found out some test failures. They all seem to be caused by the fix of hash in Ruby to avoid algorithmic complexity attacks. See [1] and [2] for more details.
Basically, the problem is, that in some tests, you rely on order of hashes, which can be different during each execution with this concrete patchlevel of Ruby. Here are the tests that fail for me (sometimes they pass, sometime they fail, because hashes get mixed):

ActiveSupport:
1) Failure:
test_escaping_to_xml(HashToXmlTest)
[./test/core_ext/hash_ext_test.rb:963:in `test_escaping_to_xml'
/usr/lib/ruby/gems/1.8/gems/mocha-0.10.0/lib/mocha/integration/test_unit/ruby_version_186_and_above.rb:22:in `__send__'
/usr/lib/ruby/gems/1.8/gems/mocha-0.10.0/lib/mocha/integration/test_unit/ruby_version_186_and_above.rb:22:in `run']:
<"First & Last NameFirst &amp; Last Name"> expected but was
<"First &amp; Last NameFirst & Last Name">.

ActiveRecord:
1) Failure:
test_should_automatically_build_new_associated_models_for_each_entry_in_a_hash_where_the_id_is_missing(TestNestedAttributesOnAHasAndBelongsToManyAssociation)
[/builddir/build/BUILD/rubygem-activerecord-3.0.11/usr/lib/ruby/gems/1.8/gems/activerecord-3.0.11/test/cases/nested_attributes_test.rb:616:in `test_should_automatically_build_new_associated_models_for_each_entry_in_a_hash_where_the_id_is_missing'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `__send__'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `run'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/callbacks.rb:419:in `_run_setup_callbacks'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:65:in `run']:
<"Grace OMalley"> expected but was
<"Privateers Greed">.

2) Failure:
test_should_automatically_build_new_associated_models_for_each_entry_in_a_hash_where_the_id_is_missing(TestNestedAttributesOnAHasManyAssociation)
[/builddir/build/BUILD/rubygem-activerecord-3.0.11/usr/lib/ruby/gems/1.8/gems/activerecord-3.0.11/test/cases/nested_attributes_test.rb:616:in `test_should_automatically_build_new_associated_models_for_each_entry_in_a_hash_where_the_id_is_missing'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `__send__'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `run'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/callbacks.rb:419:in `_run_setup_callbacks'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:65:in `run']:
<"Grace OMalley"> expected but was
<"Privateers Greed">.

ActionPack:
1) Failure:
test_response_cookies_are_added_to_the_cookie_jar_for_the_next_request(IntegrationProcessTest)
[/builddir/build/BUILD/rubygem-actionpack-3.0.11/usr/lib/ruby/gems/1.8/gems/actionpack-3.0.11/test/controller/integration_test.rb:299:in `test_response_cookies_are_added_to_the_cookie_jar_for_the_next_request'
/builddir/build/BUILD/rubygem-actionpack-3.0.11/usr/lib/ruby/gems/1.8/gems/actionpack-3.0.11/test/controller/integration_test.rb:437:in `with_test_route_set'
./test/abstract_unit.rb:219:in `with_routing'
/builddir/build/BUILD/rubygem-actionpack-3.0.11/usr/lib/ruby/gems/1.8/gems/actionpack-3.0.11/test/controller/integration_test.rb:424:in `with_test_route_set'
/builddir/build/BUILD/rubygem-actionpack-3.0.11/usr/lib/ruby/gems/1.8/gems/actionpack-3.0.11/test/controller/integration_test.rb:295:in `test_response_cookies_are_added_to_the_cookie_jar_for_the_next_request'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `__send__'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `run'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/callbacks.rb:429:in `_run_setup_callbacks'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:65:in `run']:
<"cookie_1=; path=/\ncookie_3=chocolate; path=/"> expected but was
<"cookie_3=chocolate; path=/\ncookie_1=; path=/">.
2) Failure:
test_rendering_a_partial_in_an_RJS_template_should_pick_the_JS_template_over_the_HTML_one(RenderRjs::TestBasic)
[./test/abstract_unit.rb:260:in `assert_body'
./test/abstract_unit.rb:268:in `assert_response'
/builddir/build/BUILD/rubygem-actionpack-3.0.11/usr/lib/ruby/gems/1.8/gems/actionpack-3.0.11/test/controller/new_base/render_rjs_test.rb:48:in `test_rendering_a_partial_in_an_RJS_template_should_pick_the_JS_template_over_the_HTML_one'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `__send__'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:67:in `run'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/callbacks.rb:429:in `_run_setup_callbacks'
/usr/lib/ruby/gems/1.8/gems/activesupport-3.0.11/lib/active_support/testing/setup_and_teardown.rb:65:in `run']:
<"$(\"customer\").update(\"JS Partial\");"> expected but was
<"$(\"customer\").update(\"HTML Partial\");">.

Obviously, this is only an issue for Ruby < 1.9, as Ruby >= 1.9 has ordered hashes and is immune to the mentioned attack.

Regards,
Bohuslav.

[1] http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/391606
[2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_7/ChangeLog?view=markup&pathrev=34151