module Sequel::Plugins::BlacklistSecurity::ClassMethods

Attributes

restricted_columns[R]

Which columns are specifically restricted in a call to set/update/new/etc. (default: not set). Some columns are restricted regardless of this setting, such as the primary key column and columns in Model::RESTRICTED_SETTER_METHODS.

Public Instance Methods

freeze() click to toggle source

Freeze restricted columns when freezing model class.

Calls superclass method
# File lib/sequel/plugins/blacklist_security.rb, line 31
def freeze
  @restricted_columns.freeze

  super
end
set_restricted_columns(*cols) click to toggle source

Set the columns to restrict when using mass assignment (e.g. set). Using this means that attempts to call setter methods for the columns listed here will cause an exception or be silently skipped (based on the strict_param_setting setting). If you have any virtual setter methods (methods that end in =) that you want not to be used during mass assignment, they need to be listed here as well (without the =).

It's generally a bad idea to rely on a blacklist approach for security. Using a whitelist approach such as set_allowed_columns or the instance level set_only or set_fields methods is usually a better choice. So use of this method is generally a bad idea.

Artist.set_restricted_columns(:records_sold)
Artist.set(:name=>'Bob', :hometown=>'Sactown') # No Error
Artist.set(:name=>'Bob', :records_sold=>30000) # Error
# File lib/sequel/plugins/blacklist_security.rb, line 50
def set_restricted_columns(*cols)
  clear_setter_methods_cache
  @restricted_columns = cols
end

Private Instance Methods

get_setter_methods() click to toggle source

If allowed_columns is not set but #restricted_columns is, remove the restricted_columns.

Calls superclass method
# File lib/sequel/plugins/blacklist_security.rb, line 59
def get_setter_methods
  meths = super
  if !allowed_columns && restricted_columns
    meths -= restricted_columns.map{|x| "#{x}="}
  end
  meths
end