Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Suggestion] Check for ransackable_scopes before checking attribute searches. #1472

Open
abMatGit opened this issue Jan 8, 2024 · 0 comments

Comments

@abMatGit
Copy link

abMatGit commented Jan 8, 2024

We are working on the new ransack security updates and wondered if it is possible to amend this piece of logic to look for ransackable_scopes before checking attribute_method?:
https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/search.rb#L105-L115

The reason is we explicitly allow certain ransack filters through ransackable_scopes method. This is the main way we greenlight ransack queries to our models. The trouble is if these scopes collide with attribute scopes then we enounter the allowlist raised deprecation error here: https://github.com/activerecord-hackery/ransack/blob/main/lib/ransack/adapters/active_record/base.rb#L112-L132

Is it possible to check for explicitly allowed ransackable_scopes before checking for interpolated attribute ransack searches?

Suggested changes:
ransack/lib/ransack/search.rb

    def method_missing(method_id, *args)
      method_name = method_id.to_s
      getter_name = method_name.sub(/=$/, ''.freeze)
      if @context.ransackable_scope?(getter_name, @context.object)
        if method_name =~ /=$/
          add_scope getter_name, args
        else
          @scope_args[method_name]
        end
      elsif base.attribute_method?(getter_name)
        base.send(method_id, *args)
      else
        super
      end
    end
abMatGit added a commit to abMatGit/ransack that referenced this issue Jan 9, 2024
abMatGit added a commit to abMatGit/ransack that referenced this issue Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant