1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
# frozen_string_literal: true
# Overrides `#serializable_hash` to raise an exception when called without the `only` option
# in order to prevent accidentally exposing attributes.
#
# An `unsafe: true` option can also be passed in to bypass this check.
#
# `#serializable_hash` is used by ActiveModel serializers like `ActiveModel::Serializers::JSON`
# which overrides `#as_json` and `#to_json`.
#
module BlocksUnsafeSerialization
extend ActiveSupport::Concern
extend ::Gitlab::Utils::Override
UnsafeSerializationError = Class.new(StandardError)
override :serializable_hash
def serializable_hash(options = nil)
return super if allow_serialization?(options)
raise UnsafeSerializationError,
"Serialization has been disabled on #{self.class.name}"
end
private
def allow_serialization?(options = nil)
return false unless options
!!(options[:only] || options[:unsafe])
end
end
|
