bp3-core 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76165d42f4b28714655519eeddedc6d08dd0b5bc9a5e919b389f173aa0bf20a0
-  data.tar.gz: dba935fa44898891607c50b377cbb4d8636300c7285592838826331cc47d5da6
+  metadata.gz: 8003ea2f7141b2360e20e0e09fb9dc8281025600b924e91609df721df5f301f9
+  data.tar.gz: a6be8300ea89743527193fd112da8b85808d1b9203e0eac33fa3b303e4407656
 SHA512:
-  metadata.gz: 548dd80c8000de996d2abe85c4e158b979e9c809957f1403f15519280ee2dcb3c1fa865bf4355bc6fa25d9a6cf19791bc09cf3d6d0a84b7c0a7888cdd4960c21
-  data.tar.gz: 6dbc07299dcc22c84643250fd8fe018dc2b8c94de6a30fe303431d61f38438ffa32c897f43132a49d4fa9d75491ceb33cf11e988c9c2a88e21406a7dd33e6abc
+  metadata.gz: be789a83b3e8ffd1891f624f730d1fd6bd1967a248b7a9de43a7d1d8df888b89d0f3ef4cefac5dabe0ca8198f984412b2ef9c3798c48ead18d20c0aac0721539
+  data.tar.gz: babac34019d6a4ad03722f91e8ff2b6fbe1d774415ea55a9cd84ebe80f006ba4137fe06b9f6a69b90b40d5ea0f74d9bbe4d4e2f2453e58487305b9bcb8e4054e

data/CHANGELOG.md

@@ -1,8 +1,22 @@
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-30
+
+### Security
+
+- Tighten ransack allowlist. Add `Bp3::Core::Ransackable::Explore`, a stricter answer to ransack's allowlist
+  questions. Asked with `Bp3::Core::Ransackable::EXPLORE` as the `auth_object`, `Ransackable` no longer allows every
+  column and association: it refuses encrypted attributes, columns matching `filter_parameters`, columns
+  of a `json`, `jsonb`, `binary`, `tsvector`, `vector` or `halfvec` type, and what a model names in
+  `unexplorable_columns`, and allows only the associations a model names in `explorable_associations`.
+  Any other `auth_object` gets the answer it always got
+- A model that must not allow plain ransack includes `Explore` alone; it answers nothing to any other
+  `auth_object`
+
 ## [0.3.0] - 2026-10-26
 
 ### Breaking
+
 - Scope Tenantable by the primary login
   Tenantable default scopes reach as far as the primary login, the request state's
   `current_login` (the least privileged one signed in), rather than as far as any root or admin signed

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    bp3-core (0.3.0)
+    bp3-core (0.4.0)
       actionview (~> 8.1)
       activesupport (~> 8.1)
       bp3-request_state (~> 0.1)

data/lib/bp3/core/ransackable/explore.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'active_support/concern'
+require 'active_support/core_ext/class/attribute'
+require 'active_support/parameter_filter'
+
+module Bp3
+  module Core
+    module Ransackable
+      EXPLORE = :explore
+
+      # Explore answers ransack's allowlist questions when asked with EXPLORE as the auth_object. It
+      # allows the columns and the ransackers, but never an encrypted attribute, a column matching
+      # filter_parameters, a column of a type that cannot be grouped or read as a value, or one the
+      # model names in unexplorable_columns; and only the associations the model names in
+      # explorable_associations. Ransack asks a joined model with the same auth_object, so the target
+      # of an allowed association is held to the same rules.
+      #
+      # Ransackable includes this. A model that must not allow plain ransack includes this alone: it
+      # answers nothing to any other auth_object, since defining these methods is what ransack takes
+      # as an allowlist.
+      module Explore
+        extend ActiveSupport::Concern
+
+        UNEXPLORABLE_TYPES = %i[json jsonb binary tsvector vector halfvec].freeze
+
+        included do
+          # Override in subclasses: the associations an explore filter may join through
+          class_attribute :explorable_associations, instance_accessor: false, default: []
+          # Override in subclasses: columns explore may not touch that no other rule catches
+          class_attribute :unexplorable_columns, instance_accessor: false, default: []
+        end
+
+        class_methods do
+          def ransackable_attributes(auth_object = nil)
+            return [] unless auth_object == EXPLORE
+
+            exceptions = Ransackable.attribute_exceptions.map(&:to_s)
+            column_names.map(&:to_s) + _ransackers.keys - exceptions - unexplorable_attributes
+          end
+
+          def ransackable_associations(auth_object = nil)
+            return [] unless auth_object == EXPLORE
+
+            reflect_on_all_associations.map { |reflection| reflection.name.to_s } & explorable_associations.map(&:to_s)
+          end
+
+          def unexplorable_attributes
+            filter = ActiveSupport::ParameterFilter.new(Ransackable.filter_parameters + filter_attributes)
+            names = column_names.map(&:to_s)
+            filtered = names.reject { |name| filter.filter(name => name)[name] == name }
+            typed = columns.select { |column| UNEXPLORABLE_TYPES.include?(column.type) }.map(&:name)
+            encrypted_attributes.to_a.map(&:to_s) + filtered + typed + unexplorable_columns.map(&:to_s)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/bp3/core/ransackable.rb

@@ -1,14 +1,23 @@
 # frozen_string_literal: true
 
+require_relative 'ransackable/explore'
+
 module Bp3
-  # Bp3::Ransackable provides class methods expected by models that use ransack
+  # Bp3::Ransackable provides class methods expected by models that use ransack. It allows every column
+  # and association, except when asked with EXPLORE as the auth_object: Explore answers that.
   module Core
     module Ransackable
       extend ActiveSupport::Concern
 
+      include Explore
+
       mattr_accessor :attribute_exceptions, default: []
       mattr_accessor :association_exceptions, default: []
 
+      def self.filter_parameters
+        defined?(Rails) ? Rails.application.config.filter_parameters : []
+      end
+
       class_methods do
         def ransackable_fields(auth_object = nil)
           fields =
@@ -18,12 +27,16 @@ module Bp3
           fields.map(&:to_sym).uniq
         end
 
-        def ransackable_attributes(_auth_object = nil)
+        def ransackable_attributes(auth_object = nil)
+          return super if auth_object == EXPLORE
+
           except = attribute_exceptions.map(&:to_s)
           column_names.map(&:to_s) - except
         end
 
-        def ransackable_associations(_auth_object = nil)
+        def ransackable_associations(auth_object = nil)
+          return super if auth_object == EXPLORE
+
           except = association_exceptions.map(&:to_s)
           reflect_on_all_associations.map(&:name).map(&:to_s) - except
         end

data/lib/bp3/core/version.rb

@@ -2,6 +2,6 @@
 
 module Bp3
   module Core
-    VERSION = '0.3.0'
+    VERSION = '0.4.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bp3-core
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Wim den Braven
@@ -146,6 +146,7 @@ files:
 - lib/bp3/core/displayable.rb
 - lib/bp3/core/feature_flags.rb
 - lib/bp3/core/ransackable.rb
+- lib/bp3/core/ransackable/explore.rb
 - lib/bp3/core/rqid.rb
 - lib/bp3/core/settings.rb
 - lib/bp3/core/sqnr.rb