module Sequel::Plugins::BlacklistSecurity::ClassMethods
Attributes
Which columns are specifically restricted in a call to set/update/new/etc. (default: not set). Some columns are restricted regardless of this setting, such as the primary key column and columns in Model::RESTRICTED_SETTER_METHODS.
Public Instance Methods
Freeze restricted columns when freezing model class.
# File lib/sequel/plugins/blacklist_security.rb 31 def freeze 32 @restricted_columns.freeze 33 34 super 35 end
Set the columns to restrict when using mass assignment (e.g. set
). Using this means that attempts to call setter methods for the columns listed here will cause an exception or be silently skipped (based on the strict_param_setting
setting). If you have any virtual setter methods (methods that end in =) that you want not to be used during mass assignment, they need to be listed here as well (without the =).
It’s generally a bad idea to rely on a blacklist approach for security. Using a whitelist approach such as the whitelist_security plugin or the set_fields methods is usually a better choice. So use of this method is generally a bad idea.
Artist.set_restricted_columns(:records_sold) Artist.set(name: 'Bob', hometown: 'Sactown') # No Error Artist.set(name: 'Bob', records_sold: 30000) # Error
# File lib/sequel/plugins/blacklist_security.rb 50 def set_restricted_columns(*cols) 51 clear_setter_methods_cache 52 @restricted_columns = cols 53 end
Private Instance Methods
If allowed_columns is not set but restricted_columns
is, remove the restricted_columns.
# File lib/sequel/plugins/blacklist_security.rb 59 def get_setter_methods 60 meths = super 61 if (!defined?(::Sequel::Plugins::WhitelistSecurity::ClassMethods) || !is_a?(::Sequel::Plugins::WhitelistSecurity::ClassMethods) || !allowed_columns) && restricted_columns 62 meths -= restricted_columns.map{|x| "#{x}="} 63 end 64 meths 65 end