Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Whitelist HashWithIndifferentAccess for field serialization #1192

Merged
merged 1 commit into from
Oct 28, 2023

Conversation

steveyken
Copy link
Member

We currently store field configuration in the table using the YAML coder and HashWithIndifferentAccess class.

This PR ensures HashWithIndifferentAccess is whitelisted in the YAML coder.

A future PR could migrate away from HashWithIndifferentAccess and use Ruby's standard Hash class instead. This would require a migration script to ensure all Hash keys were converted and thoroughly consistent throughout the all. i.e all to string or all to symbol.

@steveyken steveyken requested a review from CloCkWeRX October 28, 2023 06:18
@steveyken
Copy link
Member Author

steveyken commented Oct 28, 2023

Note there are potential security downsides (denial of service caused by immutable symbols causing memory exhaution) related to enabling HashWithIndifferentAccess in the YAML coders across the board. However, I believe our app entry points for YAML in general are related to the settings.yml file (controlled by administrator) and custom field administration (controlled by CRM admins). Therefore it seems like a sensible trade-off to continue supporting the existing feature until a PR to migrate away is proposed.

@CloCkWeRX CloCkWeRX merged commit d8fc400 into master Oct 28, 2023
8 checks passed
@CloCkWeRX CloCkWeRX deleted the field-serialization branch October 28, 2023 12:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants