Deprecate :controller and :action path parameters

[pixeltrix]

Allowing :controller and :action values to be specified via the path in config/routes.rb has been an underlying cause of a number of issues in Rails that have resulted in security releases. In light of this it's
better that controllers and actions are explicitly whitelisted rather than trying to blacklist or sanitize 'bad' values.

WDYT? @dhh @rafaelfranca @tenderlove

[dhh]

👍

[fxn]

👍

[rafaelfranca]

[bogdan]

hallelujah!

[elliotwesoff]

Is there some other way to draw dynamic routes in Rails 5.1? I'm maintaining an enormous Rails app that was built on Rails 1 and almost every link_to uses this convention. Adding the standard resources definitions to the routes file for every controller and changing every link_to is simply out of the question. Are there any other options?

[henrik]

Ran into this updating an old app. This was our workaround:

-        get "/:action", controller: "sections", constraints: ->(request) {
-          action = request.path_parameters[:action]
-          AdminCompanySection::ALL.include?(action)
-        }, as: :section
+        # Also see `Admin::BaseController.admin_company_section_path`.
+        AdminCompanySection::ALL.each do |section|
+          get section, controller: "sections", action: section, as: "#{section}_section"
+        end

And in Admin::BaseController:

helper_method \
def admin_company_section_path(company, section, **args)
  public_send("admin_company_#{section}_section_path", company, **args)
end

[ashrafalzyoud]

resources :invoices do
  member do
    get :client_view
  end
  collection do
    get :auto_complete
    get :bulk_edit, :context_menu
    post :bulk_edit, :bulk_update
    delete :bulk_destroy
    get :recurring
  end
  resources :invoice_mails, :only => [:new] do
    collection do
      post :send_mail, :preview_mail
    end
  end
end

resources :invoices do
  resources :invoice_payments, :as => :payments
end

resources :invoice_payments, :only => [:show, :index]
resources :projects do
  resources :invoice_templates, :only => [:new, :create]

  resources :invoice_imports, :only => [:new, :create, :show] do
    member do
      get :settings
      post :settings
      get :mapping
      post :mapping
      get :run
      post :run
    end
  end

  resources :expense_imports, :only => [:new, :create, :show] do
    member do
      get :settings
      post :settings
      get :mapping
      post :mapping
      get :run
      post :run
    end
  end
end

resources :invoice_templates do
  member do
    get :preview
  end
  collection do
    post :add
  end
end

resources :invoice_reports, only: [:new, :create] do
  collection do
    get :create
    get :autocomplete
    get :preview
  end
end

resources :expenses do
    collection do
      get :bulk_edit, :context_menu
      post :bulk_edit, :bulk_update
      delete :bulk_destroy
    end
end

resources :invoice_imports, :only => [:new, :create]
resources :expense_imports, :only => [:new, :create]
resources :invoice_comments, :only => [:create, :destroy]

resources :projects do
resources :invoices, :only => [:index, :new, :create]
  resources :expenses, :only => [:index, :new, :create]
end

match "invoice_time_entries/new", :controller => "invoice_time_entries", :action => 'new', :via => :get
match "invoice_time_entries/create", :controller => "invoice_time_entries", :action => 'create', :via => :post

DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)
DEPRECATION WARNING: Using a dynamic :action segment in a route is deprecated and will be removed in Rails 6.0. (called from instance_eval at /home/redmine/4.11/config/routes.rb:370)

[henrik]

@ashrafalzyoud Are you asking for help with solving this issue? Please use Stack Overflow for that, referencing this issue, and including the specific part of your routes that the deprecation warning points to – I don't believe it's included in the code you pasted here :)

[ashrafalzyoud]

@henrik
thx for your time and your help and support

 366  Dir.glob File.expand_path("#{Redmine::Plugin.directory}/*") do |plugin_dir|
 367 file = File.join(plugin_dir, "config/routes.rb")
 368   if File.exists?(file)
 369      begin
 370       instance_eval File.read(file)
 371   rescue SyntaxError, StandardError => e
 372       puts "An error occurred while loading the routes definition of #{File.basename(plugin_dir)}   372  plugin (#{file}): #{e.message}."
373        exit 1
374      end

this code in redmine
config/routes.rb

[henrik]

@ashrafalzyoud Hi! Sorry, I probably wasn't clear – please use https://stackoverflow.com/questions/ask to ask your question. There will be a lot more people available to help you there than in this issue :)