8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
# File 'lib/query_guard/action_controller_subscriber.rb', line 8
def self.install!(config)
return if @installed
@subscriber = ActiveSupport::Notifications.subscribe(EVENT) do |_name, _start, _finish, _id, payload|
stats = Thread.current[:query_guard_stats]
next unless stats
next unless config.enable_security && config.detect_mass_assignment
keys = Array(payload[:keys]).map(&:to_s)
sensitive = keys & Array(config.sensitive_param_keys)
stats[:violations] << {
type: :mass_assignment_unpermitted_params,
keys: keys.take(50),
sensitive_keys: sensitive.take(50)
}
end
@installed = true
end
|