kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Eliminate instance level writers for class accessors

Browse source 
Instance level writers can have an impact on how the Active Model /
Record objects are saved.  Specifically, they can be used to bypass
validations.  This is a problem if mass assignment protection is
disabled and specific attributes are passed to the constructor.

CVE-2016-0753
This commit is contained in:
Aaron Patterson 2016-01-18 13:51:02 -08:00
parent b7758b40fc
commit 4642d68d80
6 changed files with 9 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
activemodel/lib/active_model/serializers/json.rb
View file

@ -10,7 +10,7 @@ module ActiveModel
included do included do
extend ActiveModel::Naming extend ActiveModel::Naming
class_attribute :include_root_in_json class_attribute :include_root_in_json, instance_writer: false
self.include_root_in_json = false self.include_root_in_json = false
end end

3
activemodel/lib/active_model/validations.rb
View file

@ -47,9 +47,10 @@ module ActiveModel
include HelperMethods include HelperMethods
attr_accessor :validation_context attr_accessor :validation_context
private :validation_context=
define_callbacks :validate, scope: :name define_callbacks :validate, scope: :name
class_attribute :_validators class_attribute :_validators, instance_writer: false
self._validators = Hash.new { |h,k| h[k] = [] } self._validators = Hash.new { |h,k| h[k] = [] }
end end

2
activerecord/lib/active_record/enum.rb
View file

@ -95,7 +95,7 @@ module ActiveRecord
module Enum module Enum
def self.extended(base) # :nodoc: def self.extended(base) # :nodoc:
base.class_attribute(:defined_enums) base.class_attribute(:defined_enums, instance_writer: false)
base.defined_enums = {} base.defined_enums = {}
end end

4
activerecord/lib/active_record/reflection.rb
View file

@ -7,8 +7,8 @@ module ActiveRecord
extend ActiveSupport::Concern extend ActiveSupport::Concern
included do included do
class_attribute :_reflections class_attribute :_reflections, instance_writer: false
class_attribute :aggregate_reflections class_attribute :aggregate_reflections, instance_writer: false
self._reflections = {} self._reflections = {}
self.aggregate_reflections = {} self.aggregate_reflections = {}
end end

2
activerecord/lib/active_record/scoping/default.rb
View file

@ -6,7 +6,7 @@ module ActiveRecord
included do included do
# Stores the default scope for the class. # Stores the default scope for the class.
class_attribute :default_scopes, instance_writer: false, instance_predicate: false class_attribute :default_scopes, instance_writer: false, instance_predicate: false
class_attribute :default_scope_override, instance_predicate: false class_attribute :default_scope_override, instance_writer: false, instance_predicate: false
self.default_scopes = [] self.default_scopes = []
self.default_scope_override = nil self.default_scope_override = nil

4
activesupport/lib/active_support/callbacks.rb
View file

@ -71,7 +71,7 @@ module ActiveSupport
# halt the entire callback chain and display a deprecation message. # halt the entire callback chain and display a deprecation message.
# If false, callback chains will only be halted by calling +throw :abort+. # If false, callback chains will only be halted by calling +throw :abort+.
# Defaults to +true+. # Defaults to +true+.
mattr_accessor(:halt_and_display_warning_on_return_false) { true } mattr_accessor(:halt_and_display_warning_on_return_false, instance_writer: false) { true }
# Runs the callbacks for the given event. # Runs the callbacks for the given event.
# #
@ -742,7 +742,7 @@ module ActiveSupport
options = names.extract_options! options = names.extract_options!
names.each do |name| names.each do |name|
class_attribute "_#{name}_callbacks" class_attribute "_#{name}_callbacks", instance_writer: false
set_callbacks name, CallbackChain.new(name, options) set_callbacks name, CallbackChain.new(name, options)
module_eval <<-RUBY, __FILE__, __LINE__ + 1 module_eval <<-RUBY, __FILE__, __LINE__ + 1