From a1c216e5e4f566b762e185ad36bf566f14268cba Mon Sep 17 00:00:00 2001 From: Dylan Griffith Date: Fri, 26 Apr 2019 13:27:06 +1000 Subject: [PATCH] Use #public_send instead #method.call These builder methods are using user provided input inside a public_send but this is safe to do in this instance because before they are called we check before calling them that they match an expected application name. --- app/services/clusters/applications/create_service.rb | 4 ++-- app/services/clusters/applications/destroy_service.rb | 2 +- app/services/clusters/applications/update_service.rb | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/services/clusters/applications/create_service.rb b/app/services/clusters/applications/create_service.rb index ae36da7b3dd..f723c42c049 100644 --- a/app/services/clusters/applications/create_service.rb +++ b/app/services/clusters/applications/create_service.rb @@ -10,8 +10,8 @@ module Clusters end def builder - cluster.method("application_#{application_name}").call || - cluster.method("build_application_#{application_name}").call + cluster.public_send(:"application_#{application_name}") || # rubocop:disable GitlabSecurity/PublicSend + cluster.public_send(:"build_application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend end end end diff --git a/app/services/clusters/applications/destroy_service.rb b/app/services/clusters/applications/destroy_service.rb index fc74e1300a9..f3a4c4f754a 100644 --- a/app/services/clusters/applications/destroy_service.rb +++ b/app/services/clusters/applications/destroy_service.rb @@ -16,7 +16,7 @@ module Clusters private def builder - cluster.method("application_#{application_name}").call + cluster.public_send(:"application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend end end end diff --git a/app/services/clusters/applications/update_service.rb b/app/services/clusters/applications/update_service.rb index 5071c31839c..0fa937da865 100644 --- a/app/services/clusters/applications/update_service.rb +++ b/app/services/clusters/applications/update_service.rb @@ -10,7 +10,7 @@ module Clusters end def builder - cluster.method("application_#{application_name}").call + cluster.public_send(:"application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend end end end