1 files changed, 21 insertions, 0 deletions
diff --git a/config/initializers/cve_2013_6414.rb b/config/initializers/cve_2013_6414.rb
new file mode 100644
index 00000000000..f166e4d1de4
--- /dev/null
+++ b/config/initializers/cve_2013_6414.rb
@@ -0,0 +1,21 @@
+# Monkey patch for Ruby on Rails vulnerability CVE-2013-6414
+# https://groups.google.com/d/msg/ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ
+
+ActiveSupport.on_load(:action_view) do
+  ActionView::LookupContext::DetailsKey.class_eval do
+    class << self
+      alias :old_get :get
+
+      def get(details)
+        if details[:formats]
+          details = details.dup
+          syms    = Set.new Mime::SET.symbols
+          details[:formats] = details[:formats].select { |v|
+            syms.include? v
+          }
+        end
+        old_get details
+      end
+    end
+  end
+end