glib-web 5.1.1 → 5.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/app/controllers/concerns/glib/params/allowlist.rb +23 -0
- metadata +2 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 8e7848fb02064447620d8fca19a5f94b27c135b5e6c40dcd3c16974d19bb84e7
|
|
4
|
+
data.tar.gz: e187535507305543f7c5c9a5734393d60c89fd1167bf488489963b304dd92f44
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 555954cb635653ad23d9af3da7810db47bf87b4ad6807d029a5294fcb1212eee02cefa64f96a97e819c11d1a5ed3134855329e722e18207df20c0f0153011e8e
|
|
7
|
+
data.tar.gz: fde96a7c67e9f8e718d0cb7c8de72dd882e49607965891040fadf6c5b71e20be4ef2f3f69cb810662d585434ad1e650174569c0ddc87959c601fd10cdeadb189
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
module Glib::Params
|
|
2
|
+
module Allowlist
|
|
3
|
+
extend ActiveSupport::Concern
|
|
4
|
+
|
|
5
|
+
# Resolve a stringly-typed request param (or any boundary string) to one
|
|
6
|
+
# symbol drawn from a closed allow-list (+allowed_symbols+), returning
|
|
7
|
+
# +default+ when the value is missing, blank, or not recognised.
|
|
8
|
+
#
|
|
9
|
+
# This is the symbol-DoS-safe replacement for `params[:x].to_sym`. A bare
|
|
10
|
+
# `.to_sym` on a raw value mints a symbol for every distinct string a client
|
|
11
|
+
# sends, including values you intend to reject on the next line, the classic
|
|
12
|
+
# symbol-DoS vector. This only ever returns a symbol already present in
|
|
13
|
+
# +allowed_symbols+ (or +default+), so attacker input can never create a new
|
|
14
|
+
# symbol regardless of what is sent.
|
|
15
|
+
#
|
|
16
|
+
# nil / "" fall through to +default+ implicitly (no symbol's string form is
|
|
17
|
+
# blank). Use it for any closed-vocabulary boundary input: interval
|
|
18
|
+
# selectors, status filters, UTM tags, feature-flag names.
|
|
19
|
+
def glib_allowlist_symbol_param(value, allowed_symbols, default:)
|
|
20
|
+
allowed_symbols.find { |symbol| symbol.to_s == value.to_s } || default
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
end
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: glib-web
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 5.1.
|
|
4
|
+
version: 5.1.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- ''
|
|
@@ -170,6 +170,7 @@ files:
|
|
|
170
170
|
- app/controllers/concerns/glib/json/traversal.rb
|
|
171
171
|
- app/controllers/concerns/glib/json/ui.rb
|
|
172
172
|
- app/controllers/concerns/glib/json/validation.rb
|
|
173
|
+
- app/controllers/concerns/glib/params/allowlist.rb
|
|
173
174
|
- app/controllers/glib/blob_url_generators_controller.rb
|
|
174
175
|
- app/controllers/glib/errors_controller.rb
|
|
175
176
|
- app/controllers/glib/glib_direct_uploads_controller.rb
|