rabl 0.14.4 → 0.14.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 319983ae5fd329b2650da09ab880866b0f07f4d81bc722a27c9d0305fd1a77af
-  data.tar.gz: 7b6b13b88d7da8b770e1f4cc8aaa0d3193f50f01b0f57980a4ce8071538e4849
+  metadata.gz: 7f8f5c72fe30d17c5b7c2ae3aca6e6656d7ffe7328af4500a7bc05b768e4565e
+  data.tar.gz: bc687948b0f47252b5bc1adb82e93de1799accc7cfd4ed7dbb553229f8e5a0d4
 SHA512:
-  metadata.gz: b1362d83db64761f01d4080168836f8eba428679b71d81b099aed9280b9b8a4514ad3ba02a318371eb1749a4321610e6da111f7a73450898894a702f075611be
-  data.tar.gz: 0f321dcb3312a35df5f5381aa66af94a527c526c529922994346d8833c72ec986f8879de6050c7bc35dfbe333bc4257846ddb3d70d74406e94b0cab0c65aaaf3
+  metadata.gz: ae6541b60f172489bb74441ec17e2e47b8512793b3476b6dbcdd85db147437a23200817f8a78422a739043b3ebd824dfc8662bc5160058160579149bd1ffb840
+  data.tar.gz: 7e09471906df9571caff5afb224d0231fa9b9fc177d0422fbaf2d81cd631958b8bfbb802ec221965140b0214152f561172614b37967b0ccc8742886e9ec16dc5

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 0.14.5 (May 29th, 2021)
+
+* Restrict and validate the `to_***` methods available within engine (Brian McFadden)
+
 ## 0.14.4 (April 1st, 2021)
 
 * Test against latest Ruby versions

data/README.md

@@ -184,9 +184,9 @@ If `replace_nil_values_with_empty_strings` is set to `true`, all values that are
 
 If `exclude_nil_values` is set to `true`, all values that are `nil` and would normally be displayed as `null` in the response are not included in the response.
 
-if `exclude_empty_values_in_collections` is set to `true`, all vaules in a collection that are `{}` and would normally be displayed as `{}` in the response are not included in the response.
+if `exclude_empty_values_in_collections` is set to `true`, all values in a collection that are `{}` and would normally be displayed as `{}` in the response are not included in the response.
 
-If `camelize_keys` is set to `true`, all object keys will be converted to camel case. By default the first character will be lower case. The value can be set to `:upper` to set the first chracter to upper case.
+If `camelize_keys` is set to `true`, all object keys will be converted to camel case. By default the first character will be lower case. The value can be set to `:upper` to set the first character to upper case.
 
 If you wish to use [oj](https://github.com/ohler55/oj) as
 the primary JSON encoding engine simply add that to your Gemfile:

data/lib/rabl/engine.rb

@@ -6,6 +6,7 @@ module Rabl
 
     # List of supported rendering formats
     FORMATS = [:json, :xml, :plist, :bson, :msgpack]
+    SAFE_FORMATS = FORMATS + [:mpac, :dumpable, :hash]
 
     # Constructs a new ejs engine based on given vars, handler and declarations
     # Rabl::Engine.new("...source...", { :format => "xml", :root => true, :view_path => "/path/to/views" })
@@ -395,6 +396,10 @@ module Rabl
         defined?(Rails) && Rails.version =~ /^[456]/
       end
 
+      def valid_format?(format)
+        SAFE_FORMATS.include?(format.to_sym) && respond_to?("to_#{format}")
+      end
+
       def set_instance_variables!(context_scope, locals)
         @_context_scope = context_scope
         @_locals        = locals || {}
@@ -403,6 +408,9 @@ module Rabl
 
         @_options[:format] ||= request_format
 
+        # Prevent calls to inherited methods `to_yaml`, `to_enum`, etc.
+        @_options[:format] = 'json' unless valid_format?(@_options[:format])
+
         set_locals(@_locals)
       end
 

data/lib/rabl/version.rb

@@ -1,3 +1,3 @@
 module Rabl
-  VERSION = "0.14.4"
+  VERSION = "0.14.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabl
 version: !ruby/object:Gem::Version
-  version: 0.14.4
+  version: 0.14.5
 platform: ruby
 authors:
 - Nathan Esquenazi
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-02 00:00:00.000000000 Z
+date: 2021-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -169,7 +169,7 @@ homepage: https://github.com/nesquena/rabl
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -185,7 +185,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.0.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: General ruby templating with json, bson, xml and msgpack support
 test_files: []