Module: ConcernsOnRails::Support::ScalarParam

Defined in:
lib/concerns_on_rails/support/scalar_param.rb

Overview

Guards against query-param type confusion. A client can make any params value an Array (?page[]=1) or a nested hash (?page[x]=1, which Rails exposes as ActionController::Parameters); calling .to_i on those — or passing them to .where — raises and surfaces as a 500. Controller concerns route untrusted param reads through here instead.

Class Method Summary collapse

Class Method Details

.scalar?(value) ⇒ Boolean

A single scalar value, safe for .to_i / string coercion.

Returns:

  • (Boolean) 


12
13
14
 
# File 'lib/concerns_on_rails/support/scalar_param.rb', line 12

def scalar?(value)
  value.is_a?(String) || value.is_a?(Numeric)
end

.to_i(value, default: 0) ⇒ Object

Coerce an untrusted param to Integer, falling back to default for anything non-scalar (Array/Parameters/nil).



30
31
32
 
# File 'lib/concerns_on_rails/support/scalar_param.rb', line 30

def to_i(value, default: 0)
  scalar?(value) ? value.to_i : default
end

.where_safe?(value) ⇒ Boolean

Safe to pass to .where(column: value): scalars and nil are fine, and Arrays become IN (...) — but only when every member is itself where-safe (?status[][x]=1 yields [Parameters], which AR cannot quote). Hash-likes (Hash / ActionController::Parameters) are not safe.

Returns:

  • (Boolean) 


20
21
22
23
24
25
26
 
# File 'lib/concerns_on_rails/support/scalar_param.rb', line 20

def where_safe?(value)
  return value.all? { |member| where_safe?(member) } if value.is_a?(Array)
  return false if value.is_a?(Hash)
  return false if defined?(ActionController::Parameters) && value.is_a?(ActionController::Parameters)

  true
end