firm 0.9.3 → 0.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c1c7b999e2db422d608d8aaf8e28a9bace6824640f50a8e5dabb30e2ca89a36
-  data.tar.gz: a16d62247a09cc2e1d8b3c4d2a990ffefb7b48c18f6f1d8f27e12c770ff103eb
+  metadata.gz: 8a4a4e31a319e92f4e5efb708562832f1072602084f5c0b4907c88d1e28d2c1b
+  data.tar.gz: 0e9e64b8fb301c3f895fe0b76978d6794389d0ca651339fd132396866d05eefa
 SHA512:
-  metadata.gz: 6c45a0bc530a143ad8b37de7e00f6fdd4a2af91ffb52b18ce86f91ffac390ea05825d58b042e29361a96fd762be58d210d141bdb88d9748c3232e7c30232b8cc
-  data.tar.gz: 939fe265f4f55f1255851e5f246b73ca416c6649af2ffcdad6aa8fb63341289ef64c71678bc02a7372c66acd6a91a26111ebc049d2a571b5f3f189f7010d3fb2
+  metadata.gz: 6144308bc7ba7bba7cac24c173a8fbabcac75e3074d29205593c64173696c7b9c41b47c5747b1265ad680f437d87abbce400e9ea0f311b8417403be4faeb55a8
+  data.tar.gz: 32353706f381e81dcacb705bbe144464fef1233df920dcb45d21e3386fca873bbd6ae52b7a1825cff84fec88d43a68935c89ad7577e9fa8f31f1e618c6cba8c4

data/README.md

@@ -43,6 +43,10 @@ FIRM supports (de-)serializing many core Ruby objects out of the box including:
 - `Date`
 - `DateTime`
 
+For security reasons FIRM does **not** support direct (de-)serializing of `Class` objects but will rather
+serialize (and deserialize) these as their scoped string names. Customized property setters can be used to
+resolve Class objects from these names if really needed.
+
 FIRM also supports a simple scheme to provide (de-)serialization support for user defined classes. 
 
 FIRM provides object aliasing support for JSON and XML in a similar fashion as the standard support provided

data/lib/firm/serializable.rb

@@ -143,6 +143,12 @@ module FIRM
 
     class << self
 
+      TLS_VARS_KEY = :firm_tls_vars.freeze
+
+      def tls_vars
+        Thread.current[TLS_VARS_KEY] ||= {}
+      end
+
       def serializables
         @serializables ||= ::Set.new
       end
@@ -198,7 +204,7 @@ module FIRM
       private_constant :TLS_ALIAS_STACK_KEY
 
       def anchor_object_registry_stack
-        ::Thread.current[TLS_ANCHOR_OBJECTS_KEY] ||= []
+        Serializable.tls_vars[TLS_ANCHOR_OBJECTS_KEY] ||= []
       end
       private :anchor_object_registry_stack
 
@@ -252,7 +258,7 @@ module FIRM
       end
 
       def anchor_references_stack
-        ::Thread.current[TLS_ALIAS_STACK_KEY] ||= []
+        Serializable.tls_vars[TLS_ALIAS_STACK_KEY] ||= []
       end
       private :anchor_references_stack
 
@@ -658,9 +664,8 @@ module FIRM
           derived.class_eval <<~__CODE
             module SerializerMethods 
               def for_serialize(hash, excludes = ::Set.new)
-                hash = super(hash, excludes | #{derived.name}.excluded_serializer_properties) 
                 #{derived.name}.serializer_properties.each { |prop| prop.serialize(self, hash, excludes) }
-                hash 
+                super(hash, excludes | #{derived.name}.excluded_serializer_properties) 
               end
               protected :for_serialize
   

data/lib/firm/serializer/json.rb

@@ -70,7 +70,7 @@ module FIRM
         private_constant :TLS_PARSE_STACK_KEY
 
         def safe_deserialize
-          ::Thread.current[TLS_SAFE_DESERIALIZE_KEY] ||= []
+          Serializable.tls_vars[TLS_SAFE_DESERIALIZE_KEY] ||= []
         end
         private :safe_deserialize
 
@@ -83,7 +83,7 @@ module FIRM
         end
 
         def parse_stack
-          ::Thread.current[TLS_PARSE_STACK_KEY] ||= []
+          Serializable.tls_vars[TLS_PARSE_STACK_KEY] ||= []
         end
         private :parse_stack
 

data/lib/firm/serializer/xml.rb

@@ -20,7 +20,7 @@ module FIRM
           private_constant :TLS_STATE_KEY
 
           def xml_state
-            ::Thread.current[TLS_STATE_KEY] ||= []
+            Serializable.tls_vars[TLS_STATE_KEY] ||= []
           end
           private :xml_state
 
@@ -133,6 +133,22 @@ module FIRM
           end
         end
 
+        # registered as tag 'Class' but that is never actually used
+        define_xml_handler(::Class, 'Class') do
+          # overload to emit 'String' tags
+          def create_type_node(xml)
+            xml.add_child(Nokogiri::XML::Node.new('String', xml.document))
+          end
+          def to_xml(xml, value)
+            create_type_node(xml).add_child(Nokogiri::XML::CDATA.new(xml.document, value.name))
+            xml
+          end
+          def from_xml(xml)
+            # should never be called
+            raise Serializable::Exception, 'Unsupported Class deserialization'
+          end
+        end
+
         define_xml_handler(::NilClass, :nil) do
           def to_xml(xml, _value)
             create_type_node(xml)

data/lib/firm/serializer/yaml.rb

@@ -68,8 +68,26 @@ module FIRM
         end
       end
 
+      # Derived Psych YAMLTree class to emit simple strings for
+      # Class instances
+      class NoClassYAMLTree < ::Psych::Visitors::YAMLTree
+
+        def visit_Class(o)
+          raise TypeError, "can't dump anonymous module: #{o}" unless o.name
+          visit_String(o.name)
+        end
+
+        def visit_Module(o)
+          raise TypeError, "can't dump anonymous class: #{o}" unless o.name
+          visit_String(o.name)
+        end
+
+      end
+
       def self.dump(obj, io=nil, **)
-        ::YAML.dump(obj, io)
+        visitor = YAML::NoClassYAMLTree.create
+        visitor << obj
+        visitor.tree.yaml io
       end
 
       def self.load(source)

data/lib/firm/version.rb

@@ -4,6 +4,6 @@
 module FIRM
 
   # FIRM version
-  VERSION = "0.9.3"
+  VERSION = "0.9.7"
 
 end

data/tests/serializer_tests.rb

@@ -292,6 +292,17 @@ module SerializerTestMixin
 
   end
 
+  def test_class
+
+    obj_serial = [Point, Colour].serialize
+    obj_new = assert_nothing_raised { FIRM.deserialize(obj_serial) }
+    assert_instance_of(::Array, obj_new)
+    assert_true(obj_new.all? { |e| String === e })
+    assert_equal(Point.name, obj_new[0])
+    assert_equal(Colour.name, obj_new[1])
+
+  end
+
   class PointsOwner
     include FIRM::Serializable
 
@@ -596,6 +607,90 @@ module SerializerTestMixin
     assert_equal(obj_new.map[:five].object_id, obj_new.map[:six].object_id)
   end
 
+  class Shape
+    include FIRM::Serializable
+    property :kind
+
+    def initialize(kind = :circle)
+      @kind = kind
+    end
+
+    attr_accessor :kind
+  end
+
+  class ShapeOwner
+    include FIRM::Serializable
+    property :shapes
+    def initialize
+      @shapes = []
+    end
+
+    attr_accessor :shapes
+  end
+
+  class Grid < ShapeOwner
+    property :dimensions
+    property :cells
+
+    DIMENSIONS = Struct.new(:rows, :columns)
+
+    def initialize(rows=nil, columns=nil)
+      super()
+      @dimensions = DIMENSIONS.new(rows || 3, columns || 3)
+      @cells = ::Array.new(@dimensions.rows*@dimensions.columns)
+    end
+
+    attr_reader :dimensions
+
+    def place_shape_at(row, col, shape)
+      shapes << shape
+      @cells[(row*dimensions.columns)+col] = shape
+      self
+    end
+
+    def get_shape_at(row, col)
+      @cells.at((row*dimensions.columns)+col)
+    end
+
+
+    private
+
+    def set_dimensions(dimensions)
+      @dimensions = dimensions
+    end
+
+    def get_cells
+      @cells
+    end
+
+    def set_cells(cells)
+      @cells = cells
+    end
+  end
+
+  def test_inherited_aliases
+
+    grid = Grid.new(2,2)
+               .place_shape_at(0, 0, Shape.new(:circle))
+               .place_shape_at(0, 1, Shape.new(:rect))
+               .place_shape_at(1,0, Shape.new(:cross))
+               .place_shape_at(1,1, Shape.new(:diamond))
+    obj_serial = grid.serialize
+    grid_new = assert_nothing_raised { FIRM.deserialize(obj_serial) }
+    assert_instance_of(Grid, grid_new)
+    assert_equal(4, grid_new.shapes.size)
+    assert_equal(:circle, grid_new.get_shape_at(0, 0).kind)
+    assert_equal(:rect, grid_new.get_shape_at(0, 1).kind)
+    assert_equal(:cross, grid_new.get_shape_at(1, 0).kind)
+    assert_equal(:diamond, grid_new.get_shape_at(1, 1).kind)
+    2.times do |r|
+      2.times do |c|
+        assert_true(grid_new.shapes.include?(grid_new.get_shape_at(r, c)))
+      end
+    end
+
+  end
+
   class House
 
     include FIRM::Serializable

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: firm
 version: !ruby/object:Gem::Version
-  version: 0.9.3
+  version: 0.9.7
 platform: ruby
 authors:
 - Martin Corino
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-14 00:00:00.000000000 Z
+date: 2024-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake