glib-web 5.1.2 → 5.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e7848fb02064447620d8fca19a5f94b27c135b5e6c40dcd3c16974d19bb84e7
-  data.tar.gz: e187535507305543f7c5c9a5734393d60c89fd1167bf488489963b304dd92f44
+  metadata.gz: d834dc054cfc079edbcf57609a2d05b4ad8837a8abfea74f3d75d75d546235a6
+  data.tar.gz: 850b0614ff17f7b436c49593bcfc28d2559dcf19505b543093f498f1c255817f
 SHA512:
-  metadata.gz: 555954cb635653ad23d9af3da7810db47bf87b4ad6807d029a5294fcb1212eee02cefa64f96a97e819c11d1a5ed3134855329e722e18207df20c0f0153011e8e
-  data.tar.gz: fde96a7c67e9f8e718d0cb7c8de72dd882e49607965891040fadf6c5b71e20be4ef2f3f69cb810662d585434ad1e650174569c0ddc87959c601fd10cdeadb189
+  metadata.gz: 859713dca4f2084b66389beadfcac6468d94b9d93006a1dedc7bf238eb68ce9e98ba1cbe89871e563a2e63c627624291778d811ae29c3f4a263badae8277adaf
+  data.tar.gz: 8c25c1f91953477464b2fd238c06c8ee8ddbb0d943ef2848c14b359a6ce137c79e35d7c4591812fe312785664a072cc101be04f6fd14f664a3ab108368a015d8

data/app/controllers/concerns/glib/auth/policy.rb

@@ -101,7 +101,16 @@ module Glib::Auth
         end
       end
 
-      resource_instance = instance_variable_get("@#{resource_name}") || options[:resource] || policy_name
+      resource_instance = instance_variable_get("@#{resource_name}")
+      if resource_instance.nil?
+        # An explicitly supplied `resource:` is authoritative even when nil (e.g. a scoped
+        # `find_by` that resolved nothing). Falling back to the policy-name symbol would hand
+        # the policy a truthy placeholder in place of the missing record, so record-bound gates
+        # (`record.present?`, `return false unless record`) would pass for exactly the request
+        # they exist to refuse -- fail-open. Pass the nil through so they fail closed. The
+        # symbol fallback remains for callers that don't supply `resource:` at all.
+        resource_instance = options.key?(:resource) ? options[:resource] : policy_name
+      end
 
       query = "#{action_name}?"
       policy_instance = policy(resource_instance, policy_name, options.fetch(:context, nil))

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -2,6 +2,13 @@ module Glib::Params
   module Allowlist
     extend ActiveSupport::Concern
 
+    # Raised when a MUTATING request submits a present-but-unrecognised value:
+    # real clients only submit values the UI offered, so a mismatch means a
+    # value was forgotten from the allow-list or the client is broken — both
+    # must surface (via the consumer's 500/reporting pipeline), not silently
+    # degrade into the wrong behavior.
+    class UnrecognizedValue < StandardError; end
+
     # Resolve a stringly-typed request param (or any boundary string) to one
     # symbol drawn from a closed allow-list (+allowed_symbols+), returning
     # +default+ when the value is missing, blank, or not recognised.
@@ -13,11 +20,32 @@ module Glib::Params
     # +allowed_symbols+ (or +default+), so attacker input can never create a new
     # symbol regardless of what is sent.
     #
-    # nil / "" fall through to +default+ implicitly (no symbol's string form is
-    # blank). Use it for any closed-vocabulary boundary input: interval
-    # selectors, status filters, UTM tags, feature-flag names.
+    # Degrade-vs-raise is decided by the REQUEST METHOD:
+    # - GET/HEAD: unrecognised values quietly degrade to +default+ — crawlers
+    #   and bots probe read endpoints with garbage, and a filter page must not
+    #   500 on `?mode=garbage`.
+    # - Mutating requests (POST/PATCH/PUT/DELETE): a PRESENT-but-unrecognised
+    #   value raises UnrecognizedValue (see above) — this is how a forgotten
+    #   allow-list entry announces itself instead of hiding.
+    # Blank/missing values fall through to +default+ quietly on EVERY method
+    # (forms legitimately post no value; no symbol's string form is blank).
+    #
+    # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
+    # — the matched entry is symbolized on the way out, so the return value is
+    # ALWAYS a symbol (or +default+). That `to_sym` runs only on the
+    # developer-controlled list entry, never on +value+, so the DoS-safety
+    # above is unaffected.
     def glib_allowlist_symbol_param(value, allowed_symbols, default:)
-      allowed_symbols.find { |symbol| symbol.to_s == value.to_s } || default
+      match = allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym
+      return match if match
+
+      if value.present? && !request.get? && !request.head?
+        raise UnrecognizedValue,
+              "Unrecognised #{request.request_method} param value #{value.to_s.truncate(80).inspect} " \
+              "(allowed: #{allowed_symbols.map(&:to_sym).inspect})"
+      end
+
+      default
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.1.2
+  version: 5.1.4
 platform: ruby
 authors:
 - ''