Contents

module ActiveRecord
  class Base
    private
    def write_attribute(attr_name, value)
      attr_name = attr_name.to_s
      if (column = column_for_attribute(attr_name)) && column.number?
        @attributes[attr_name] = convert_number_column_value(value)
      else
        if self.class.serialized_attributes[attr_name] && value.is_a?(String) && value =~ /^---/
          raise ActiveRecordError, "You tried to assign already serialized content to #{attr_name}. This is disabled due to security issues."
        end
        @attributes[attr_name] = value
      end
    end
    # For comparison, this is the original write_attribue from rails 1.2.6
    # def write_attribute(attr_name, value)
    #   attr_name = attr_name.to_s
    #   if (column = column_for_attribute(attr_name)) && column.number?
    #     @attributes[attr_name] = convert_number_column_value(value)
    #   else
    #     @attributes[attr_name] = value
    #   end
    # end
    # For comparison this is the patch from rails 2.3
    # def define_write_method_for_serialized_attribute(attr_name)
    #   method_body = <<-EOV
    #     def #{attr_name}=(value)
    #       if value.is_a?(String) and value =~ /^---/
    #         raise ActiveRecordError, "You tried to assign already serialized content to #{attr_name}. This is disabled due to security issues."
    #       end
    #       write_attribute(:#{attr_name}, value)
    #     end
    #   EOV
    #   evaluate_attribute_method attr_name, method_body, "#{attr_name}="
    # end
  end
end

Version data entries

3 entries across 3 versions & 1 rubygems

Version	Path
rails-security-backports-0.0.3	lib/rails-security-backports/rails-cve-backports/cve-2013-0277.rb
rails-security-backports-0.0.2	lib/rails-security-backports/rails-cve-backports/cve-2013-0277.rb
rails-security-backports-0.0.1	lib/rails-security-backports/rails-cve-backports/cve-2013-0277.rb