Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend dangerous attribute methods with dangerous methods from Object #45883

Merged
merged 1 commit into from
Aug 25, 2022

Conversation

fatkodima
Copy link
Member

Fixes #45879 (see there for more details).

Another option would be not to exclude the methods that were inherited, but then have a small exclusion list for Object methods that are unlikely to be a problem and are common names (e.g. Object#display).

I do not like this approach, because this list can possibly be incomplete for some concrete apps. For example, some gem can monkey patch Object with some popular name and with this approach this name now will be dangerous.

Another reason, this approach (besides properties) also makes methods with arguments as dangerous. But this is not needed, because when the user will pass arguments, then this will blow up, showing that he is doing something wrong.

So I propose to add a small explicit list of the most likely used dangerous methods. I did not add __send__/send/method_missing/etc (as mentioned in #45879 (comment)), because they require arguments and this will already blow up and won't go unnoticed.

cc @byroot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

No implicit conversion of String into Integer (TypeError) - when commiting record to the database
2 participants