glib-web 5.1.3 → 5.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54f283b08cba85e7935323705254ff4c53831314f87a71661f11761d4be37544
-  data.tar.gz: df856aaa88383c8e54384d8d0a6ed81536f5457efc0b523d1cf5dba0ef558a9b
+  metadata.gz: d834dc054cfc079edbcf57609a2d05b4ad8837a8abfea74f3d75d75d546235a6
+  data.tar.gz: 850b0614ff17f7b436c49593bcfc28d2559dcf19505b543093f498f1c255817f
 SHA512:
-  metadata.gz: d4011507ec92ac5666c5af93ef6b7cca59444fdae226b20a805a2582e1710138b9839ed0f430ca585b7fb3f2120d1d541a0120c61655347defa7b90344d631eb
-  data.tar.gz: 548c0fcd1edb93c05f846acf93114b818127ccb5e3e5c8f1c65dad2c195ba8e9b66ca12d2aef37344c622d321ad9b799d1794bcc9314f7f524db7840194f6ecf
+  metadata.gz: 859713dca4f2084b66389beadfcac6468d94b9d93006a1dedc7bf238eb68ce9e98ba1cbe89871e563a2e63c627624291778d811ae29c3f4a263badae8277adaf
+  data.tar.gz: 8c25c1f91953477464b2fd238c06c8ee8ddbb0d943ef2848c14b359a6ce137c79e35d7c4591812fe312785664a072cc101be04f6fd14f664a3ab108368a015d8

data/app/controllers/concerns/glib/params/allowlist.rb

@@ -2,6 +2,13 @@ module Glib::Params
   module Allowlist
     extend ActiveSupport::Concern
 
+    # Raised when a MUTATING request submits a present-but-unrecognised value:
+    # real clients only submit values the UI offered, so a mismatch means a
+    # value was forgotten from the allow-list or the client is broken — both
+    # must surface (via the consumer's 500/reporting pipeline), not silently
+    # degrade into the wrong behavior.
+    class UnrecognizedValue < StandardError; end
+
     # Resolve a stringly-typed request param (or any boundary string) to one
     # symbol drawn from a closed allow-list (+allowed_symbols+), returning
     # +default+ when the value is missing, blank, or not recognised.
@@ -13,9 +20,15 @@ module Glib::Params
     # +allowed_symbols+ (or +default+), so attacker input can never create a new
     # symbol regardless of what is sent.
     #
-    # nil / "" fall through to +default+ implicitly (no symbol's string form is
-    # blank). Use it for any closed-vocabulary boundary input: interval
-    # selectors, status filters, UTM tags, feature-flag names.
+    # Degrade-vs-raise is decided by the REQUEST METHOD:
+    # - GET/HEAD: unrecognised values quietly degrade to +default+ — crawlers
+    #   and bots probe read endpoints with garbage, and a filter page must not
+    #   500 on `?mode=garbage`.
+    # - Mutating requests (POST/PATCH/PUT/DELETE): a PRESENT-but-unrecognised
+    #   value raises UnrecognizedValue (see above) — this is how a forgotten
+    #   allow-list entry announces itself instead of hiding.
+    # Blank/missing values fall through to +default+ quietly on EVERY method
+    # (forms legitimately post no value; no symbol's string form is blank).
     #
     # +allowed_symbols+ may also contain strings (e.g. a Rails enum's `.keys`)
     # — the matched entry is symbolized on the way out, so the return value is
@@ -23,7 +36,16 @@ module Glib::Params
     # developer-controlled list entry, never on +value+, so the DoS-safety
     # above is unaffected.
     def glib_allowlist_symbol_param(value, allowed_symbols, default:)
-      allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym || default
+      match = allowed_symbols.find { |symbol| symbol.to_s == value.to_s }&.to_sym
+      return match if match
+
+      if value.present? && !request.get? && !request.head?
+        raise UnrecognizedValue,
+              "Unrecognised #{request.request_method} param value #{value.to_s.truncate(80).inspect} " \
+              "(allowed: #{allowed_symbols.map(&:to_sym).inspect})"
+      end
+
+      default
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 5.1.3
+  version: 5.1.4
 platform: ruby
 authors:
 - ''