Log for which keys values were set to nil in deep_munge#13813
Log for which keys values were set to nil in deep_munge#13813rafaelfranca merged 1 commit intorails:masterfrom lukesarnacki:log-deep-munge
Conversation
actionpack/CHANGELOG.md
Outdated
|
Seems a good plan to me. |
|
👍 |
|
@rafaelfranca @chancancode I fixed typos and made logs a little bit smarter, so i.e. |
|
@rafaelfranca @chancancode I added deep_munge description in guides. One mention is in action controller overview in "Hash and array parameters" section, second one is in security guide as "Unsafe query generation" chapter. I think it covers this well, I am not sure if this is in proper place when it comes to security guide. Output of command will look like: (new line here is made for better readibility) |
There was a problem hiding this comment.
Should be "in params" since we are talking about the method. If we are talking about the parameters, it should be "in parameters"
There was a problem hiding this comment.
There is an extra space between the penultimate period and "See". Could you also wrap new additions around 80 chars please ? 😃
|
@rafaelfranca I corrected mistakes you pointed out and added mention in configuration guide. @robin850 Yeah, that line started to be very long ;) I changed it to multiline string. |
There was a problem hiding this comment.
Could you wrap your additions around 80 chars please ? The other guides aren't wrapped too. 😄
Also, this will need to be rebased. Thanks for the great work here so far! 👍
There was a problem hiding this comment.
Hey, thanks for heads up, is it ok now? :)
deep_munge solves CVE-2013-0155 security vulnerability, but its behaviour is definately confuisng. This commit adds logging to deep_munge. It logs keys for which values were set to nil. Also mentions in guides were added.
Log for which keys values were set to nil in deep_munge
|
Thank @lukesarnacki. Very good PR as always ❤️ |
|
Thanks @rafaelfranca :) |
5 participants
I think we all want deep_munge to be gone soon, but I am afraid that we will have to wait little bit longer. There are many developers which are not aware of this behaviour so I thought that it would be nice of RoR if there was some kind of hint of what actually happened, so I added log message when value is set to
nilin deep_munge.I hope that with #13420 we will quickly make code from this PR go away, but in case it will take bit longer...
Any suggestions for better log message would be awesome.