glib-web 5.1.1 → 5.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 783a7ad2cc1fcb744c02e91df3185c7d455c6bef84d56fc0eff2503f3a39f826
-  data.tar.gz: 960797098836ddd26a310b592f953f46284f986bde09f42deae1b889a5a85cd1
+  metadata.gz: 54f283b08cba85e7935323705254ff4c53831314f87a71661f11761d4be37544
+  data.tar.gz: df856aaa88383c8e54384d8d0a6ed81536f5457efc0b523d1cf5dba0ef558a9b
 SHA512:
-  metadata.gz: e5a23a583b69403fd8a65db92b658fb2aab0b7ca6e2946ba4da0e39d194504b2ed9694c638167d68828b92c97d7c3851746eb189be75576ec777201e8ad570a1
-  data.tar.gz: 43ac55043ae8321c33aa4c662b5f4833be211cf0d95f6cc9f8ad5b16f4b7685a4a475e5e0c77d3c01c99292f1401577a8b600f2e863055274582c1a5d0997bfb
+  metadata.gz: d4011507ec92ac5666c5af93ef6b7cca59444fdae226b20a805a2582e1710138b9839ed0f430ca585b7fb3f2120d1d541a0120c61655347defa7b90344d631eb
+  data.tar.gz: 548c0fcd1edb93c05f846acf93114b818127ccb5e3e5c8f1c65dad2c195ba8e9b66ca12d2aef37344c622d321ad9b799d1794bcc9314f7f524db7840194f6ecf

data/app/controllers/concerns/glib/auth/policy.rb

@@ -101,7 +101,16 @@ module Glib::Auth
         end
       end
 
-      resource_instance = instance_variable_get("@#{resource_name}") || options[:resource] || policy_name
+      resource_instance = instance_variable_get("@#{resource_name}")
+      if resource_instance.nil?
+        # An explicitly supplied `resource:` is authoritative even when nil (e.g. a scoped
+        # `find_by` that resolved nothing). Falling back to the policy-name symbol would hand
+        # the policy a truthy placeholder in place of the missing record, so record-bound gates
+        # (`record.present?`, `return false unless record`) would pass for exactly the request
+        # they exist to refuse -- fail-open. Pass the nil through so they fail closed. The
+        # symbol fallback remains for callers that don't supply `resource:` at all.
+        resource_instance = options.key?(:resource) ? options[:resource] : policy_name
+      end
 
       query = "#{action_name}?"
       policy_instance = policy(resource_instance, policy_name, options.fetch(:context, nil))

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -0,0 +1,29 @@
+module Glib::Params
+  module Allowlist
+    extend ActiveSupport::Concern
+
+    # Resolve a stringly-typed request param (or any boundary string) to one
+    # symbol drawn from a closed allow-list (+allowed_symbols+), returning
+    # +default+ when the value is missing, blank, or not recognised.
+    #
+    # This is the symbol-DoS-safe replacement for `params[:x].to_sym`. A bare
+    # `.to_sym` on a raw value mints a symbol for every distinct string a client
+    # sends, including values you intend to reject on the next line, the classic
+    # symbol-DoS vector. This only ever returns a symbol already present in
+    # +allowed_symbols+ (or +default+), so attacker input can never create a new
+    # symbol regardless of what is sent.
+    #
+    # nil / "" fall through to +default+ implicitly (no symbol's string form is
+    # blank). Use it for any closed-vocabulary boundary input: interval
+    # selectors, status filters, UTM tags, feature-flag names.
+    #
+    # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
+    # — the matched entry is symbolized on the way out, so the return value is
+    # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
+    # developer-controlled list entry, never on +value+, so the DoS-safety
+    # above is unaffected.
+    def glib_allowlist_symbol_param(value, allowed_symbols, default:)
+      allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym || default
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.1.1
+  version: 5.1.3
 platform: ruby
 authors:
 - ''
@@ -170,6 +170,7 @@ files:
 - app/controllers/concerns/glib/json/traversal.rb
 - app/controllers/concerns/glib/json/ui.rb
 - app/controllers/concerns/glib/json/validation.rb
+- app/controllers/concerns/glib/params/allowlist.rb
 - app/controllers/glib/blob_url_generators_controller.rb
 - app/controllers/glib/errors_controller.rb
 - app/controllers/glib/glib_direct_uploads_controller.rb