Monkey patch for CVE-2012-2660 and CVE-2012-2694 on Rails 2.3.14

strip_nil_from_parameters.rb

# Monkey patch for CVE-2012-2660 and CVE-2012-2694 on Rails 2.3.14
# put this file in your config/initializers directory
# comments/corrections: https://gist.github.com/2854095

# Strip [nil] from parameters hash
# based on a pull request from @sebbacon
# https://github.com/rails/rails/pull/6580

module ActionController
  class Request < Rack::Request
    protected
      def deep_munge(hash)
        keys = hash.keys.find_all { |k| hash[k] == [nil] }
        keys.each { |k| hash[k] = nil }
      
        hash.each_value do |v|
          case v
          when Array
            v.grep(Hash) { |x| deep_munge(x) }
            v.compact!
          when Hash
            deep_munge(v)
          end
        end
    
        hash
      end

    private
      def normalize_parameters(value)
        case value
        when Hash
          if value.has_key?(:tempfile)
            upload = value[:tempfile]
            upload.extend(UploadedFile)
            upload.original_path = value[:filename]
            upload.content_type = value[:type]
            upload
          else
            h = {}
            value.each { |k, v| h[k] = normalize_parameters(v) }
            deep_munge(h.with_indifferent_access)
          end
        when Array
          value.map { |e| normalize_parameters(e) }
        else
          value
        end
      end

  end
end

Looks great! Thanks for putting this together.