aboutsummaryrefslogtreecommitdiffstats
path: root/activesupport
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2016-01-18 13:51:02 -0800
committerAaron Patterson <aaron.patterson@gmail.com>2016-01-22 15:02:46 -0800
commit4642d68d8021893c69bfd16ed6e926ae03a6d777 (patch)
treebe212b3810e264ca10cdf015d576773fa27f27ed /activesupport
parentb7758b40fc035a47f6843158155606d455314c42 (diff)
downloadrails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.gz
rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.bz2
rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.zip
Eliminate instance level writers for class accessors
Instance level writers can have an impact on how the Active Model / Record objects are saved. Specifically, they can be used to bypass validations. This is a problem if mass assignment protection is disabled and specific attributes are passed to the constructor. CVE-2016-0753
Diffstat (limited to 'activesupport')
-rw-r--r--activesupport/lib/active_support/callbacks.rb4
1 files changed, 2 insertions, 2 deletions
diff --git a/activesupport/lib/active_support/callbacks.rb b/activesupport/lib/active_support/callbacks.rb
index bf560ec1fa..e6baddf5db 100644
--- a/activesupport/lib/active_support/callbacks.rb
+++ b/activesupport/lib/active_support/callbacks.rb
@@ -71,7 +71,7 @@ module ActiveSupport
# halt the entire callback chain and display a deprecation message.
# If false, callback chains will only be halted by calling +throw :abort+.
# Defaults to +true+.
- mattr_accessor(:halt_and_display_warning_on_return_false) { true }
+ mattr_accessor(:halt_and_display_warning_on_return_false, instance_writer: false) { true }
# Runs the callbacks for the given event.
#
@@ -742,7 +742,7 @@ module ActiveSupport
options = names.extract_options!
names.each do |name|
- class_attribute "_#{name}_callbacks"
+ class_attribute "_#{name}_callbacks", instance_writer: false
set_callbacks name, CallbackChain.new(name, options)
module_eval <<-RUBY, __FILE__, __LINE__ + 1