Merge pull request #26640 from Shopify/fix-am-errors-to-hash-default-proc

Do not leak the Errors default proc when calling to_hash or as_json

2 files changed, 11 insertions, 1 deletions

diff --git a/activemodel/lib/active_model/errors.rb b/activemodel/lib/active_model/errors.rb
index 191039f598..72746e194e 100644
--- a/activemodel/lib/active_model/errors.rb
+++ b/activemodel/lib/active_model/errors.rb
@@ -280,7 +280,7 @@ module ActiveModel
           messages[attribute] = array.map { |message| full_message(attribute, message) }
         end
       else
-        messages.dup
+        without_default_proc(messages)
       end
     end
 
diff --git a/activemodel/test/cases/errors_test.rb b/activemodel/test/cases/errors_test.rb
index 3288b5543c..95ca1f3969 100644
--- a/activemodel/test/cases/errors_test.rb
+++ b/activemodel/test/cases/errors_test.rb
@@ -250,6 +250,16 @@ class ErrorsTest < ActiveModel::TestCase
     assert_equal({ name: ["cannot be blank"] }, person.errors.to_hash)
   end
 
+  test "to_hash returns a hash without default proc" do
+    person = Person.new
+    assert_nil person.errors.to_hash.default_proc
+  end
+
+  test "as_json returns a hash without default proc" do
+    person = Person.new
+    assert_nil person.errors.as_json.default_proc
+  end
+
   test "full_messages creates a list of error messages with the attribute name included" do
     person = Person.new
     person.errors.add(:name, "cannot be blank")