{"action":"closed","number":6689,"pull_request":{"url":"https://api.github.com/repos/spree/spree/pulls/6689","id":43105004,"html_url":"https://github.com/spree/spree/pull/6689","diff_url":"https://github.com/spree/spree/pull/6689.diff","patch_url":"https://github.com/spree/spree/pull/6689.patch","issue_url":"https://api.github.com/repos/spree/spree/issues/6689","number":6689,"state":"closed","locked":false,"title":"Urgent patch: Adjustment#update! returning nil when !source.present.","user":{"login":"archSeer","id":1372918,"avatar_url":"https://avatars.githubusercontent.com/u/1372918?v=3","gravatar_id":"","url":"https://api.github.com/users/archSeer","html_url":"https://github.com/archSeer","followers_url":"https://api.github.com/users/archSeer/followers","following_url":"https://api.github.com/users/archSeer/following{/other_user}","gists_url":"https://api.github.com/users/archSeer/gists{/gist_id}","starred_url":"https://api.github.com/users/archSeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/archSeer/subscriptions","organizations_url":"https://api.github.com/users/archSeer/orgs","repos_url":"https://api.github.com/users/archSeer/repos","events_url":"https://api.github.com/users/archSeer/events{/privacy}","received_events_url":"https://api.github.com/users/archSeer/received_events","type":"User","site_admin":false},"body":"Bug: Calling update! on an adjustment with no source always returns nil.\r\n\r\nRuby scopes variables by block scope, and onditionals do not open a new scope.\r\nEssentially, what happens in this function, is that an `amount` var is\r\nimmediately defined (at the top of the function) and set to nil.\r\n\r\nThis then completely takes precedence over the `amount` instance method,\r\nreturning nil instead of the actual amount.\r\n\r\nThe fix is to use `self.amount` when referring to the method, although a much\r\nbetter practice would be to not use vars that match real variables.\r\n\r\nPOC code sample, displaying the bug:\r\n\r\n```ruby\r\nclass A\r\n  def amount\r\n    1\r\n  end\r\n\r\n  def amount=\r\n    \"whatever\"\r\n  end\r\n\r\n  def update!\r\n    return amount if false\r\n    if false\r\n      amount = 2\r\n    end\r\n    amount\r\n  end\r\nend\r\n\r\nA.new.update! # => nil\r\n```\r\n\r\nAlso note that even if source was present, `amount=` never gets called because\r\n`amount = 2` creates a local variable, while `self.amount = 2` would call the\r\nfunction.\r\n\r\n\r\nAnalysis shows that code has been vulnerable since this specific commit: https://github.com/spree/spree/commit/3a3c94d8a4276a5a026a34015605bf1113f8b86c\r\n\r\nVulnerable versions include 2.2, 2.3 and 2.4.","created_at":"2015-08-22T15:20:36Z","updated_at":"2015-08-24T22:26:34Z","closed_at":"2015-08-24T22:26:34Z","merged_at":"2015-08-24T22:26:34Z","merge_commit_sha":"ff1781124564fd620afd2a8aab62104a2b12ad93","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/spree/spree/pulls/6689/commits","review_comments_url":"https://api.github.com/repos/spree/spree/pulls/6689/comments","review_comment_url":"https://api.github.com/repos/spree/spree/pulls/comments{/number}","comments_url":"https://api.github.com/repos/spree/spree/issues/6689/comments","statuses_url":"https://api.github.com/repos/spree/spree/statuses/1a46f9c33e7c13b79715def120c705379984ac21","head":{"label":"archSeer:adjustment-update-fix","ref":"adjustment-update-fix","sha":"1a46f9c33e7c13b79715def120c705379984ac21","user":{"login":"archSeer","id":1372918,"avatar_url":"https://avatars.githubusercontent.com/u/1372918?v=3","gravatar_id":"","url":"https://api.github.com/users/archSeer","html_url":"https://github.com/archSeer","followers_url":"https://api.github.com/users/archSeer/followers","following_url":"https://api.github.com/users/archSeer/following{/other_user}","gists_url":"https://api.github.com/users/archSeer/gists{/gist_id}","starred_url":"https://api.github.com/users/archSeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/archSeer/subscriptions","organizations_url":"https://api.github.com/users/archSeer/orgs","repos_url":"https://api.github.com/users/archSeer/repos","events_url":"https://api.github.com/users/archSeer/events{/privacy}","received_events_url":"https://api.github.com/users/archSeer/received_events","type":"User","site_admin":false},"repo":{"id":32847287,"name":"spree","full_name":"archSeer/spree","owner":{"login":"archSeer","id":1372918,"avatar_url":"https://avatars.githubusercontent.com/u/1372918?v=3","gravatar_id":"","url":"https://api.github.com/users/archSeer","html_url":"https://github.com/archSeer","followers_url":"https://api.github.com/users/archSeer/followers","following_url":"https://api.github.com/users/archSeer/following{/other_user}","gists_url":"https://api.github.com/users/archSeer/gists{/gist_id}","starred_url":"https://api.github.com/users/archSeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/archSeer/subscriptions","organizations_url":"https://api.github.com/users/archSeer/orgs","repos_url":"https://api.github.com/users/archSeer/repos","events_url":"https://api.github.com/users/archSeer/events{/privacy}","received_events_url":"https://api.github.com/users/archSeer/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/archSeer/spree","description":"Spree is a complete open source e-commerce solution for Ruby on Rails.","fork":true,"url":"https://api.github.com/repos/archSeer/spree","forks_url":"https://api.github.com/repos/archSeer/spree/forks","keys_url":"https://api.github.com/repos/archSeer/spree/keys{/key_id}","collaborators_url":"https://api.github.com/repos/archSeer/spree/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/archSeer/spree/teams","hooks_url":"https://api.github.com/repos/archSeer/spree/hooks","issue_events_url":"https://api.github.com/repos/archSeer/spree/issues/events{/number}","events_url":"https://api.github.com/repos/archSeer/spree/events","assignees_url":"https://api.github.com/repos/archSeer/spree/assignees{/user}","branches_url":"https://api.github.com/repos/archSeer/spree/branches{/branch}","tags_url":"https://api.github.com/repos/archSeer/spree/tags","blobs_url":"https://api.github.com/repos/archSeer/spree/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/archSeer/spree/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/archSeer/spree/git/refs{/sha}","trees_url":"https://api.github.com/repos/archSeer/spree/git/trees{/sha}","statuses_url":"https://api.github.com/repos/archSeer/spree/statuses/{sha}","languages_url":"https://api.github.com/repos/archSeer/spree/languages","stargazers_url":"https://api.github.com/repos/archSeer/spree/stargazers","contributors_url":"https://api.github.com/repos/archSeer/spree/contributors","subscribers_url":"https://api.github.com/repos/archSeer/spree/subscribers","subscription_url":"https://api.github.com/repos/archSeer/spree/subscription","commits_url":"https://api.github.com/repos/archSeer/spree/commits{/sha}","git_commits_url":"https://api.github.com/repos/archSeer/spree/git/commits{/sha}","comments_url":"https://api.github.com/repos/archSeer/spree/comments{/number}","issue_comment_url":"https://api.github.com/repos/archSeer/spree/issues/comments{/number}","contents_url":"https://api.github.com/repos/archSeer/spree/contents/{+path}","compare_url":"https://api.github.com/repos/archSeer/spree/compare/{base}...{head}","merges_url":"https://api.github.com/repos/archSeer/spree/merges","archive_url":"https://api.github.com/repos/archSeer/spree/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/archSeer/spree/downloads","issues_url":"https://api.github.com/repos/archSeer/spree/issues{/number}","pulls_url":"https://api.github.com/repos/archSeer/spree/pulls{/number}","milestones_url":"https://api.github.com/repos/archSeer/spree/milestones{/number}","notifications_url":"https://api.github.com/repos/archSeer/spree/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/archSeer/spree/labels{/name}","releases_url":"https://api.github.com/repos/archSeer/spree/releases{/id}","created_at":"2015-03-25T06:38:31Z","updated_at":"2015-03-25T06:38:40Z","pushed_at":"2015-08-24T19:51:56Z","git_url":"git://github.com/archSeer/spree.git","ssh_url":"git@github.com:archSeer/spree.git","clone_url":"https://github.com/archSeer/spree.git","svn_url":"https://github.com/archSeer/spree","homepage":"http://spreecommerce.com","size":73204,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"spree:2-4-stable","ref":"2-4-stable","sha":"333bbc64834dd7f94e6be82c15f25736d2aad54a","user":{"login":"spree","id":56702,"avatar_url":"https://avatars.githubusercontent.com/u/56702?v=3","gravatar_id":"","url":"https://api.github.com/users/spree","html_url":"https://github.com/spree","followers_url":"https://api.github.com/users/spree/followers","following_url":"https://api.github.com/users/spree/following{/other_user}","gists_url":"https://api.github.com/users/spree/gists{/gist_id}","starred_url":"https://api.github.com/users/spree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spree/subscriptions","organizations_url":"https://api.github.com/users/spree/orgs","repos_url":"https://api.github.com/users/spree/repos","events_url":"https://api.github.com/users/spree/events{/privacy}","received_events_url":"https://api.github.com/users/spree/received_events","type":"Organization","site_admin":false},"repo":{"id":3314,"name":"spree","full_name":"spree/spree","owner":{"login":"spree","id":56702,"avatar_url":"https://avatars.githubusercontent.com/u/56702?v=3","gravatar_id":"","url":"https://api.github.com/users/spree","html_url":"https://github.com/spree","followers_url":"https://api.github.com/users/spree/followers","following_url":"https://api.github.com/users/spree/following{/other_user}","gists_url":"https://api.github.com/users/spree/gists{/gist_id}","starred_url":"https://api.github.com/users/spree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spree/subscriptions","organizations_url":"https://api.github.com/users/spree/orgs","repos_url":"https://api.github.com/users/spree/repos","events_url":"https://api.github.com/users/spree/events{/privacy}","received_events_url":"https://api.github.com/users/spree/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/spree/spree","description":"Spree is a complete open source e-commerce solution for Ruby on Rails.","fork":false,"url":"https://api.github.com/repos/spree/spree","forks_url":"https://api.github.com/repos/spree/spree/forks","keys_url":"https://api.github.com/repos/spree/spree/keys{/key_id}","collaborators_url":"https://api.github.com/repos/spree/spree/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/spree/spree/teams","hooks_url":"https://api.github.com/repos/spree/spree/hooks","issue_events_url":"https://api.github.com/repos/spree/spree/issues/events{/number}","events_url":"https://api.github.com/repos/spree/spree/events","assignees_url":"https://api.github.com/repos/spree/spree/assignees{/user}","branches_url":"https://api.github.com/repos/spree/spree/branches{/branch}","tags_url":"https://api.github.com/repos/spree/spree/tags","blobs_url":"https://api.github.com/repos/spree/spree/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/spree/spree/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/spree/spree/git/refs{/sha}","trees_url":"https://api.github.com/repos/spree/spree/git/trees{/sha}","statuses_url":"https://api.github.com/repos/spree/spree/statuses/{sha}","languages_url":"https://api.github.com/repos/spree/spree/languages","stargazers_url":"https://api.github.com/repos/spree/spree/stargazers","contributors_url":"https://api.github.com/repos/spree/spree/contributors","subscribers_url":"https://api.github.com/repos/spree/spree/subscribers","subscription_url":"https://api.github.com/repos/spree/spree/subscription","commits_url":"https://api.github.com/repos/spree/spree/commits{/sha}","git_commits_url":"https://api.github.com/repos/spree/spree/git/commits{/sha}","comments_url":"https://api.github.com/repos/spree/spree/comments{/number}","issue_comment_url":"https://api.github.com/repos/spree/spree/issues/comments{/number}","contents_url":"https://api.github.com/repos/spree/spree/contents/{+path}","compare_url":"https://api.github.com/repos/spree/spree/compare/{base}...{head}","merges_url":"https://api.github.com/repos/spree/spree/merges","archive_url":"https://api.github.com/repos/spree/spree/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/spree/spree/downloads","issues_url":"https://api.github.com/repos/spree/spree/issues{/number}","pulls_url":"https://api.github.com/repos/spree/spree/pulls{/number}","milestones_url":"https://api.github.com/repos/spree/spree/milestones{/number}","notifications_url":"https://api.github.com/repos/spree/spree/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/spree/spree/labels{/name}","releases_url":"https://api.github.com/repos/spree/spree/releases{/id}","created_at":"2008-03-10T14:45:35Z","updated_at":"2015-08-24T22:04:00Z","pushed_at":"2015-08-24T22:26:34Z","git_url":"git://github.com/spree/spree.git","ssh_url":"git@github.com:spree/spree.git","clone_url":"https://github.com/spree/spree.git","svn_url":"https://github.com/spree/spree","homepage":"http://spreecommerce.com","size":138921,"stargazers_count":6658,"watchers_count":6658,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3135,"mirror_url":null,"open_issues_count":169,"forks":3135,"open_issues":169,"watchers":6658,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/spree/spree/pulls/6689"},"html":{"href":"https://github.com/spree/spree/pull/6689"},"issue":{"href":"https://api.github.com/repos/spree/spree/issues/6689"},"comments":{"href":"https://api.github.com/repos/spree/spree/issues/6689/comments"},"review_comments":{"href":"https://api.github.com/repos/spree/spree/pulls/6689/comments"},"review_comment":{"href":"https://api.github.com/repos/spree/spree/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/spree/spree/pulls/6689/commits"},"statuses":{"href":"https://api.github.com/repos/spree/spree/statuses/1a46f9c33e7c13b79715def120c705379984ac21"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"JDutil","id":25104,"avatar_url":"https://avatars.githubusercontent.com/u/25104?v=3","gravatar_id":"","url":"https://api.github.com/users/JDutil","html_url":"https://github.com/JDutil","followers_url":"https://api.github.com/users/JDutil/followers","following_url":"https://api.github.com/users/JDutil/following{/other_user}","gists_url":"https://api.github.com/users/JDutil/gists{/gist_id}","starred_url":"https://api.github.com/users/JDutil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDutil/subscriptions","organizations_url":"https://api.github.com/users/JDutil/orgs","repos_url":"https://api.github.com/users/JDutil/repos","events_url":"https://api.github.com/users/JDutil/events{/privacy}","received_events_url":"https://api.github.com/users/JDutil/received_events","type":"User","site_admin":false},"comments":3,"review_comments":1,"commits":2,"additions":6,"deletions":0,"changed_files":2}}