Move as_json override to ApplicationRecord

mastodon · Apr 29, 2024 · f8d0d0e · f8d0d0e
1 parent defa262
commit f8d0d0e
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 11 deletions.
diff --git a/app/models/account.rb b/app/models/account.rb
@@ -89,7 +89,6 @@ class Account < ApplicationRecord
   include DomainMaterializable
   include DomainNormalizable
   include Paginable
-  include NoImplicitSerialization
 
   enum :protocol, { ostatus: 0, activitypub: 1 }
   enum :suspension_origin, { local: 0, remote: 1 }, prefix: true

diff --git a/app/models/application_record.rb b/app/models/application_record.rb
@@ -22,4 +22,10 @@ def boolean_with_default(key, default_value)
       value
     end
   end
+
+  # Prevent implicit serialization in ActiveModel::Serializer or other code paths.
+  # This is a hardening step to avoid accidental leaking of attributes.
+  def as_json
+    raise NotImplementedError
+  end
 end
diff --git a/app/models/concerns/no_implicit_serialization.rb b/app/models/concerns/no_implicit_serialization.rb
diff --git a/app/models/user.rb b/app/models/user.rb
@@ -59,7 +59,6 @@ class User < ApplicationRecord
   include User::LdapAuthenticable
   include User::Omniauthable
   include User::PamAuthenticable
-  include NoImplicitSerialization
 
   # The home and list feeds will be stored in Redis for this amount
   # of time, and status fan-out to followers will include only people