Deprecate method "match" in routes.rb #5964

Closed
homakov opened this Issue Apr 24, 2012 · 4 comments

Projects

None yet

6 participants

@homakov
homakov commented Apr 24, 2012

My proposal is to announce 'match' method in routes.rb as deprecated and later(e.g. rails 5.0) put it to "private methods" section.

It will encourage people to use "pure" restful methods-verbs like put post get etc and will raise knowledge of their meaning and goal. (GET for retrieving data, POST for state changing requests)

Why? - my points are described at http://homakov.blogspot.com/2012/04/whitelist-your-routes-match-is-evil.html

I would love to hear your viewpoint or just a few words on the subject, thanks for taking into account!
/cc @dhh @wycats and others

@steveklabnik
Member

👍

@lightcap

👍

@Aupajo
Aupajo commented Apr 25, 2012

👍

@lucasallan

I agree.

@wycats wycats added a commit that closed this issue Apr 25, 2012
@wycats wycats Remove default match without specified method
In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964
56cdc81
@wycats wycats closed this in 56cdc81 Apr 25, 2012
@romanvbabenko romanvbabenko added a commit to romanvbabenko/rails that referenced this issue May 2, 2012
@wycats wycats Remove default match without specified method
In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964
b7012d7
@vosechu vosechu referenced this issue in lavapj/commuterapp Apr 17, 2013
James Lee Ajaxif'd the dashboard.
Updated .gitignore with more temp files;
b0d7e37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment