Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NoMethodError if Rails.application.config.filter_parameters contains a regular expression #39

Closed
thimo opened this issue Sep 18, 2023 · 2 comments

Comments

@thimo
Copy link

thimo commented Sep 18, 2023

With version 1.0.0 I see a NoMethodError for to_sym on a regular expression on Rails init. This is excerpt from the Github Action test log for the merge with 1.0.0:

NoMethodError: undefined method `to_sym' for /^((?-mix:client_secret|authentication_token|access_token|refresh_token|code))$/:Regexp
/home/runner/work/<...>/vendor/bundle/ruby/3.2.0/gems/devise-passwordless-1.0.0/lib/devise/passwordless/rails.rb:17:in `map'
/home/runner/work/<...>/vendor/bundle/ruby/3.2.0/gems/devise-passwordless-1.0.0/lib/devise/passwordless/rails.rb:17:in `block in <class:Engine>'

The issue here is that the Rails.application.config.filter_parameters array may not only contains strings or symbols, but can also contain regular expressions. In my case it's the Doorkeeper gem that adds it (https://github.com/doorkeeper-gem/doorkeeper/blob/main/lib/doorkeeper/engine.rb#L9), resulting in this array:

[1] pry(main)> Rails.application.config.filter_parameters
=> [:passw,
 :secret,
 :token,
 :_key,
 :crypt,
 :salt,
 :certificate,
 :otp,
 :ssn,
 /^((?-mix:client_secret|authentication_token|access_token|refresh_token|code))$/]

Looking at the precompiler for this filter in the Rails repo it looks to me that a regular expression should be supported (link to Rails 7.1, if I understand correctly the precompiler is new): https://github.com/rails/rails/blob/main/activesupport/lib/active_support/parameter_filter.rb#L56-L57

Not sure what the solution would be here, as the check in this project likely has to be done in a different way.

@abevoelker
Copy link
Owner

Great catch! ❤️ I think if there are non-stringy values in filter_parameters we'll assume you know what you're doing and not emit a warning. v1.0.1 with the bugfix will be on Rubygems in the next couple minutes. Thanks for the report!

@thimo
Copy link
Author

thimo commented Sep 19, 2023

Thank you so much for the quick fix, and for creating devise-passwordless. Much appreciated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants