hyper-mesh 1.0.0.lap22 → 1.0.0.lap23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 8a3f02dc7409012e66ee49ff4db2f4cf02ec7c85
-  data.tar.gz: 32671a9f75a0f055f008ad14d37b44ac28d1857f
+SHA256:
+  metadata.gz: 0dd51d3374de90e1a070483b1c3db8fd002376dcede0a581e8bddf295605357f
+  data.tar.gz: 374199c45836ce94e38ca0e4a7c82477ac21bf56c37b14294b4c1fff199dd7f8
 SHA512:
-  metadata.gz: 24cc931546b2f95946db0ae5fb176d580ae4e1198063f03304d5454f285a7e000847c4a0b6db939cf3a479d16909ad266f8a5d800c266ca8c166ecf4abb193e7
-  data.tar.gz: ba0798c845d4035db45b81f7a31d9e6da86fbbdac35cadcd9f261aaa52a19b41a91ae68524224759f334e4672d4ffd044b28c250e4ea472b3f7698540d227190
+  metadata.gz: d56429c6e9b76916a9368b1e56550a1e3fa116224703e400160e1fb8f6ec84361cf8560c3d48b0d1ffd3bbd143e7427bc5d8d60fb325d9c9fd8ccd6f5a3f1192
+  data.tar.gz: 3cdbcc9c488c9ddccb962ff1991b2c0c797bb59d772a59d0ef5237e5e1939afa56b7b8664d0285edf4391bbef9ffd1a290aac54150265ade8699a5ac2d6aa429

data/Gemfile

@@ -1,4 +1,3 @@
 source 'https://rubygems.org'
 gem "opal-jquery", git: "https://github.com/opal/opal-jquery.git", branch: "master"
-gem "opal-rails", git: "https://github.com/opal/opal-rails.git", branch: "master"
 gemspec

data/Rakefile

@@ -1,13 +1,22 @@
 require "bundler/gem_tasks"
 require "rspec/core/rake_task"
 
-RSpec::Core::RakeTask.new(:spec)
+
+
+task :spec do
+  (1..5).each { |batch| Rake::Task["spec:batch#{batch}"].invoke }
+end
 
 namespace :spec do
   task :prepare do
     sh %{bundle update}
     sh %{cd spec/test_app; bundle update; bundle exec rails db:setup} # may need ;bundle exec rails db:setup as well
   end
+  (1..5).each do |batch|
+    RSpec::Core::RakeTask.new(:"batch#{batch}") do |t|
+      t.pattern = "spec/batch#{batch}/**/*_spec.rb"
+    end
+  end
 end
 
 task :default => :spec

data/hyper-mesh.gemspec

@@ -24,7 +24,8 @@ Gem::Specification.new do |spec|
   spec.executables    = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   spec.test_files     = `git ls-files -- {spec}/*`.split("\n")
   spec.require_paths  = ['lib']
-  spec.post_install_message = "\033[0;31;1mhyper-mesh #{Hypermesh::VERSION} is in development and has know security issues! Not recommended for production use!\033[0;30;21m"
+
+  spec.post_install_message = "\033[0;31;1mhyper-mesh #{Hypermesh::VERSION} is in development and has known security issues! Not recommended for production use!\033[0;30;21m"
 
   spec.add_dependency 'activerecord', '>= 4.0.0'
   spec.add_dependency 'hyper-component', Hypermesh::VERSION
@@ -39,7 +40,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'mysql2'
   spec.add_development_dependency 'opal-activesupport', '~> 0.3.1'
   spec.add_development_dependency 'opal-browser', '~> 0.2.0'
-  spec.add_development_dependency 'opal-rails', '~> 0.9.3'
+  spec.add_development_dependency 'opal-rails', '~> 0.9.4'
   spec.add_development_dependency 'parser'
   spec.add_development_dependency 'puma'
   spec.add_development_dependency 'pusher'
@@ -63,4 +64,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'mini_racer', '~> 0.1.15'
   spec.add_development_dependency 'timecop', '~> 0.8.1'
   spec.add_development_dependency 'unparser'
+  spec.add_development_dependency 'pry'
 end

data/lib/hypermesh/version.rb

@@ -1,3 +1,3 @@
 module Hypermesh
-  VERSION = '1.0.0.lap22'
+  VERSION = '1.0.0.lap23'
 end

data/lib/reactive_record/server_data_cache.rb

@@ -97,11 +97,26 @@ module ReactiveRecord
 
       if RUBY_ENGINE != 'opal'
 
-        # SECURITY - UNSAFE
+        def self.get_model(str)
+          # We don't want to open a security hole by allowing some client side string to
+          # autoload a class, which would happen if we did a simple str.constantize.
+          #
+          # Because all AR models are loaded at boot time on the server to define the
+          # ActiveRecord::Base.public_columns_hash method any model which the client has
+          # access to should already be loaded.
+          #
+          # If str is not already loaded then we have an access violation.
+          unless const_defined? str
+            Hyperloop::InternalPolicy.raise_operation_access_violation
+          end
+          str.constantize
+        end
+
+        # SECURITY - NOW SAFE
         def [](*vector)
           root = CacheItem.new(@cache, @acting_user, vector[0], @preloaded_records)
           vector[1..-1].inject(root) { |cache_item, method| cache_item.apply_method method if cache_item }
-          vector[0] = vector[0].constantize # TODO: Security
+          vector[0] = ServerDataCache.get_model(vector[0])
           last_value = nil
           @cache.each do |cache_item|
             next if cache_item.root != root || @requested_cache_items.include?(cache_item)
@@ -162,18 +177,18 @@ module ReactiveRecord
             @vector.last
           end
 
-          # SECURITY - UNSAFE
+          # SECURITY - NOW SAFE
           def self.new(db_cache, acting_user, klass, preloaded_records)
-            klass_constant = klass.constantize # TODO: Security Risk
+            klass_constant = ServerDataCache.get_model(klass)
             if existing = db_cache.detect { |cached_item| cached_item.vector == [klass_constant] }
               return existing
             end
             super
           end
 
-          # SECURITY - UNSAFE
+          # SECURITY - NOW SAFE
           def initialize(db_cache, acting_user, klass, preloaded_records)
-            klass = klass.constantize # TODO: Security
+            klass = ServerDataCache.get_model(klass)
             @db_cache = db_cache
             @acting_user = acting_user
             @vector = @absolute_vector = [klass]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hyper-mesh
 version: !ruby/object:Gem::Version
-  version: 1.0.0.lap22
+  version: 1.0.0.lap23
 platform: ruby
 authors:
 - Mitch VanDuyn
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-16 00:00:00.000000000 Z
+date: 2018-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -31,28 +31,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
 - !ruby/object:Gem::Dependency
   name: hyper-operation
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -129,14 +129,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0.lap22
+        version: 1.0.0.lap23
 - !ruby/object:Gem::Dependency
   name: hyper-trace
   requirement: !ruby/object:Gem::Requirement
@@ -199,14 +199,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.3
+        version: 0.9.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.3
+        version: 0.9.4
 - !ruby/object:Gem::Dependency
   name: parser
   requirement: !ruby/object:Gem::Requirement
@@ -535,6 +535,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: HyperMesh is the base for HyperModel. HyperModel gives your HyperComponents
   CRUD access to your ActiveRecord models on the client, using the the standard ActiveRecord
   API. HyperModel also implements push notifications (via a number of possible technologies)
@@ -608,8 +622,8 @@ homepage: http://ruby-hyperloop.org
 licenses:
 - MIT
 metadata: {}
-post_install_message: "\e[0;31;1mhyper-mesh 1.0.0.lap22 is in development and has
-  know security issues! Not recommended for production use!\e[0;30;21m"
+post_install_message: "\e[0;31;1mhyper-mesh 1.0.0.lap23 is in development and has
+  known security issues! Not recommended for production use!\e[0;30;21m"
 rdoc_options: []
 require_paths:
 - lib
@@ -625,7 +639,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.1
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: React based CRUD access and Synchronization of active record models across