Module: Trane::ExtraAttributesFilter

Defined in:
lib/trane/extra_attributes_filter.rb

Constant Summary collapse

MAX_VALUES =

Hard cap on the number of extra_attributes values accepted from a single request. Defense-in-depth against a crafted query string that would otherwise allocate an arbitrarily large Set. Rack caps total param keys per request upstream; this caps how many of those Trane itself will materialise into a Set for one filter.

Sized well above any realistic legitimate API surface (single endpoints typically declare < 20 extra fields).

100
EMPTY =

Frozen, shared sentinel returned for every input that parses to no extras (nil, non-iterable, or empty Array). Safe to share — callers only read via include? (audited: serializer.rb:48 is the sole consumer; zero mutations across trane/lib/).

Set.new.freeze

Class Method Summary collapse

Class Method Details

.parse(params) ⇒ Set<String>

Parse extra_attributes from request params into a Set of dot-notation paths.

Parameters:

  • params (Hash, ActionController::Parameters) —

    request params

Returns:

  • (Set<String>) 


27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/trane/extra_attributes_filter.rb', line 27

def self.parse(params)
  raw = params[:extra_attributes]
  return EMPTY if raw.nil?

  values = case raw
  when Array then raw
  when String then [ raw ]
  else []
  end

  return EMPTY if values.empty?
  Set.new(values.first(MAX_VALUES).map(&:to_s))
end