diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-18 13:51:02 -0800 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-22 15:02:46 -0800 |
commit | 4642d68d8021893c69bfd16ed6e926ae03a6d777 (patch) | |
tree | be212b3810e264ca10cdf015d576773fa27f27ed | |
parent | b7758b40fc035a47f6843158155606d455314c42 (diff) | |
download | rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.gz rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.bz2 rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.zip |
Eliminate instance level writers for class accessors
Instance level writers can have an impact on how the Active Model /
Record objects are saved. Specifically, they can be used to bypass
validations. This is a problem if mass assignment protection is
disabled and specific attributes are passed to the constructor.
CVE-2016-0753
-rw-r--r-- | activemodel/lib/active_model/serializers/json.rb | 2 | ||||
-rw-r--r-- | activemodel/lib/active_model/validations.rb | 3 | ||||
-rw-r--r-- | activerecord/lib/active_record/enum.rb | 2 | ||||
-rw-r--r-- | activerecord/lib/active_record/reflection.rb | 4 | ||||
-rw-r--r-- | activerecord/lib/active_record/scoping/default.rb | 2 | ||||
-rw-r--r-- | activesupport/lib/active_support/callbacks.rb | 4 |
6 files changed, 9 insertions, 8 deletions
diff --git a/activemodel/lib/active_model/serializers/json.rb b/activemodel/lib/active_model/serializers/json.rb index b66dbf1afe..b64a8299e6 100644 --- a/activemodel/lib/active_model/serializers/json.rb +++ b/activemodel/lib/active_model/serializers/json.rb @@ -10,7 +10,7 @@ module ActiveModel included do extend ActiveModel::Naming - class_attribute :include_root_in_json + class_attribute :include_root_in_json, instance_writer: false self.include_root_in_json = false end diff --git a/activemodel/lib/active_model/validations.rb b/activemodel/lib/active_model/validations.rb index f23c920d87..8159b9b1d3 100644 --- a/activemodel/lib/active_model/validations.rb +++ b/activemodel/lib/active_model/validations.rb @@ -47,9 +47,10 @@ module ActiveModel include HelperMethods attr_accessor :validation_context + private :validation_context= define_callbacks :validate, scope: :name - class_attribute :_validators + class_attribute :_validators, instance_writer: false self._validators = Hash.new { |h,k| h[k] = [] } end diff --git a/activerecord/lib/active_record/enum.rb b/activerecord/lib/active_record/enum.rb index 7ded96f8fb..610b863794 100644 --- a/activerecord/lib/active_record/enum.rb +++ b/activerecord/lib/active_record/enum.rb @@ -95,7 +95,7 @@ module ActiveRecord module Enum def self.extended(base) # :nodoc: - base.class_attribute(:defined_enums) + base.class_attribute(:defined_enums, instance_writer: false) base.defined_enums = {} end diff --git a/activerecord/lib/active_record/reflection.rb b/activerecord/lib/active_record/reflection.rb index a549b28f16..27b9d0754b 100644 --- a/activerecord/lib/active_record/reflection.rb +++ b/activerecord/lib/active_record/reflection.rb @@ -7,8 +7,8 @@ module ActiveRecord extend ActiveSupport::Concern included do - class_attribute :_reflections - class_attribute :aggregate_reflections + class_attribute :_reflections, instance_writer: false + class_attribute :aggregate_reflections, instance_writer: false self._reflections = {} self.aggregate_reflections = {} end diff --git a/activerecord/lib/active_record/scoping/default.rb b/activerecord/lib/active_record/scoping/default.rb index cdcb73382f..c9f689ee17 100644 --- a/activerecord/lib/active_record/scoping/default.rb +++ b/activerecord/lib/active_record/scoping/default.rb @@ -6,7 +6,7 @@ module ActiveRecord included do # Stores the default scope for the class. class_attribute :default_scopes, instance_writer: false, instance_predicate: false - class_attribute :default_scope_override, instance_predicate: false + class_attribute :default_scope_override, instance_writer: false, instance_predicate: false self.default_scopes = [] self.default_scope_override = nil diff --git a/activesupport/lib/active_support/callbacks.rb b/activesupport/lib/active_support/callbacks.rb index bf560ec1fa..e6baddf5db 100644 --- a/activesupport/lib/active_support/callbacks.rb +++ b/activesupport/lib/active_support/callbacks.rb @@ -71,7 +71,7 @@ module ActiveSupport # halt the entire callback chain and display a deprecation message. # If false, callback chains will only be halted by calling +throw :abort+. # Defaults to +true+. - mattr_accessor(:halt_and_display_warning_on_return_false) { true } + mattr_accessor(:halt_and_display_warning_on_return_false, instance_writer: false) { true } # Runs the callbacks for the given event. # @@ -742,7 +742,7 @@ module ActiveSupport options = names.extract_options! names.each do |name| - class_attribute "_#{name}_callbacks" + class_attribute "_#{name}_callbacks", instance_writer: false set_callbacks name, CallbackChain.new(name, options) module_eval <<-RUBY, __FILE__, __LINE__ + 1 |