model_driven_api 3.13.0 → 3.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9fcc02687ce88ff1cc47523ddd04f9d1a7c4918d40c2f2765d59f19a1697c0dd
-  data.tar.gz: 2eb8c0586bbbdaed24d44d5c8de670ff5339df53c7d6609eedcb8559cc49e16a
+  metadata.gz: 9f71f26da0653883d6bcf4aa2382a9d6d9d51104e0f5f183f79abdf6da8cf242
+  data.tar.gz: 1cb5c008dfe9bbc44dbec5ec2bcf19670cd2c469239b0416b3a27d3ee4387387
 SHA512:
-  metadata.gz: c48fa599733f52da66626b80067df10d3cb223c3f950a3f3e4f62afe104e50f5b93778cf228b95b89268227b811e74e3b10455fd8d8a3cff0f9d8b8d0f1caf5b
-  data.tar.gz: bb50aa93d2b0ce0616e8128b9634b6e38e7fd066bb8fd7a0dba61429000dbf3d125b49930273ebe333126f8ee1104d922cf78eec8f4db6d946cb3f47768d8708
+  metadata.gz: 4407253720ea30dbd1c209fe9997461564c28035ab24b7e97bb60ccdfb1614000f8405adc94f97666d06d1799a11a5aee5f5c2e498d105a8c2c88f56c32bc007
+  data.tar.gz: 734ca5f9bc6745ebcd0ef1ef382048d3d35205e1a692bdcc6fa41ed6c2480653e590bc25bf76ad29b32b9aae27392d065ecbb45294a9da8de87e8be402114ade

data/config/brakeman.ignore

@@ -0,0 +1,28 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Remote Code Execution",
+      "warning_code": 24,
+      "fingerprint": "3a0e243d6afeb081594823f1d9102c5c6f9235211b4d2bcf3121eb57e91b65b9",
+      "check_name": "UnsafeReflection",
+      "message": "Unsafe reflection method `constantize` called on parameter value",
+      "file": "app/controllers/api/v2/application_controller.rb",
+      "line": 146,
+      "link": "https://brakemanscanner.org/docs/warning_types/remote_code_execution/",
+      "code": "\"Endpoints::#{params[:ctrl].to_s.classify}\".constantize",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "Api::V2::ApplicationController",
+        "method": "public_custom_action?"
+      },
+      "user_input": "params[:ctrl].to_s.classify",
+      "confidence": "High",
+      "cwe_id": [
+        470
+      ],
+      "note": "False positive (host Odoo #5884). The class name is always prefixed with Endpoints:: and ActiveSupport's constantize never falls back to a top-level constant (Endpoints::String raises NameError), so only an existing Endpoints::* class can be loaded; nothing is instantiated here. Guarded by the host's test/integration/api_reflection_test.rb."
+    }
+  ],
+  "brakeman_version": "8.1.0"
+}

data/lib/api/model_resolver.rb

@@ -4,17 +4,26 @@ module Api
 
     # Resolve model from params, controller_path, or controller_name.
     # Returns nil when no class can be resolved (info/utility controllers use this path).
-    # Raises NotFound when a class is resolved but is not an ActiveRecord model (and not TestApi).
+    # Raises NotFound when a class is resolved but is not a concrete ActiveRecord model (and not TestApi).
+    #
+    # The names come from the request path, so a resolved class is only ever inspected, never
+    # instantiated: checking a model with `.new` used to run the constructor of any class the
+    # path named (GET /api/v2/tempfiles created a file on the server).
     def self.resolve(params, controller_path, controller_name)
-      model = (params[:ctrl].classify.constantize rescue
-               params[:path].split("/").first.classify.constantize rescue
-               controller_path.classify.constantize rescue
-               controller_name.classify.constantize rescue
-               nil)
-      if model && model != TestApi
-        raise NotFound unless (model.new.is_a?(ActiveRecord::Base) rescue false)
-      end
+      model = [
+        params[:ctrl],
+        params[:path].to_s.split("/").first,
+        controller_path,
+        controller_name
+      ].lazy.filter_map { |name| name.to_s.classify.safe_constantize }.first
+      raise NotFound if model && model != TestApi && !model?(model)
+
       model
     end
+
+    def self.model?(klass)
+      klass.is_a?(Class) && klass < ActiveRecord::Base && !klass.abstract_class?
+    end
+    private_class_method :model?
   end
 end

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.13.0".freeze
+  VERSION = "3.13.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.13.0
+  version: 3.13.1
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -192,6 +192,7 @@ files:
 - app/models/endpoints/test_api.rb
 - app/models/test_api.rb
 - app/models/used_token.rb
+- config/brakeman.ignore
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/auto_include_json.rb
 - config/initializers/cors_api_thecore.rb