Add tests and changelog entry to previous commit

shrinerb · Jan 11, 2016 · 12a7fb2 · 12a7fb2
1 parent c576959
commit 12a7fb2
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,7 @@
 ## HEAD
 
+* Prevent multiline content type spoof attempts in validation_helpers (xzo)
+
 * Make custom metadata inherited from uploaded files and make `#extract_metadata` called only on caching (janko-m)
 
 ## 1.1.0 (2015-12-26)

diff --git a/test/plugin/validation_helpers_test.rb b/test/plugin/validation_helpers_test.rb
@@ -100,6 +100,13 @@
       assert_empty @attacher.errors
     end
 
+    it "scans multiline strings" do
+      @attacher.assign(fakeio(content_type: "video/mpeg4\nfoo"))
+      @attacher.validate_mime_type_inclusion ["video/mpeg4"]
+
+      refute_empty @attacher.errors
+    end
+
     it "accepts regexes" do
       @attacher.assign(fakeio(content_type: "video/mpeg4"))
       @attacher.validate_mime_type_inclusion [/image/]