{"action":"created","issue":{"url":"https://api.github.com/repos/spree/spree/issues/6689","labels_url":"https://api.github.com/repos/spree/spree/issues/6689/labels{/name}","comments_url":"https://api.github.com/repos/spree/spree/issues/6689/comments","events_url":"https://api.github.com/repos/spree/spree/issues/6689/events","html_url":"https://github.com/spree/spree/pull/6689","id":102544497,"number":6689,"title":"Urgent patch: Adjustment#update! returning nil when !source.present.","user":{"login":"archSeer","id":1372918,"avatar_url":"https://avatars.githubusercontent.com/u/1372918?v=3","gravatar_id":"","url":"https://api.github.com/users/archSeer","html_url":"https://github.com/archSeer","followers_url":"https://api.github.com/users/archSeer/followers","following_url":"https://api.github.com/users/archSeer/following{/other_user}","gists_url":"https://api.github.com/users/archSeer/gists{/gist_id}","starred_url":"https://api.github.com/users/archSeer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/archSeer/subscriptions","organizations_url":"https://api.github.com/users/archSeer/orgs","repos_url":"https://api.github.com/users/archSeer/repos","events_url":"https://api.github.com/users/archSeer/events{/privacy}","received_events_url":"https://api.github.com/users/archSeer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-22T15:20:36Z","updated_at":"2015-08-24T22:27:28Z","closed_at":"2015-08-24T22:26:34Z","pull_request":{"url":"https://api.github.com/repos/spree/spree/pulls/6689","html_url":"https://github.com/spree/spree/pull/6689","diff_url":"https://github.com/spree/spree/pull/6689.diff","patch_url":"https://github.com/spree/spree/pull/6689.patch"},"body":"Bug: Calling update! on an adjustment with no source always returns nil.\r\n\r\nRuby scopes variables by block scope, and onditionals do not open a new scope.\r\nEssentially, what happens in this function, is that an `amount` var is\r\nimmediately defined (at the top of the function) and set to nil.\r\n\r\nThis then completely takes precedence over the `amount` instance method,\r\nreturning nil instead of the actual amount.\r\n\r\nThe fix is to use `self.amount` when referring to the method, although a much\r\nbetter practice would be to not use vars that match real variables.\r\n\r\nPOC code sample, displaying the bug:\r\n\r\n```ruby\r\nclass A\r\n  def amount\r\n    1\r\n  end\r\n\r\n  def amount=\r\n    \"whatever\"\r\n  end\r\n\r\n  def update!\r\n    return amount if false\r\n    if false\r\n      amount = 2\r\n    end\r\n    amount\r\n  end\r\nend\r\n\r\nA.new.update! # => nil\r\n```\r\n\r\nAlso note that even if source was present, `amount=` never gets called because\r\n`amount = 2` creates a local variable, while `self.amount = 2` would call the\r\nfunction.\r\n\r\n\r\nAnalysis shows that code has been vulnerable since this specific commit: https://github.com/spree/spree/commit/3a3c94d8a4276a5a026a34015605bf1113f8b86c\r\n\r\nVulnerable versions include 2.2, 2.3 and 2.4."},"comment":{"url":"https://api.github.com/repos/spree/spree/issues/comments/134399564","html_url":"https://github.com/spree/spree/pull/6689#issuecomment-134399564","issue_url":"https://api.github.com/repos/spree/spree/issues/6689","id":134399564,"user":{"login":"JDutil","id":25104,"avatar_url":"https://avatars.githubusercontent.com/u/25104?v=3","gravatar_id":"","url":"https://api.github.com/users/JDutil","html_url":"https://github.com/JDutil","followers_url":"https://api.github.com/users/JDutil/followers","following_url":"https://api.github.com/users/JDutil/following{/other_user}","gists_url":"https://api.github.com/users/JDutil/gists{/gist_id}","starred_url":"https://api.github.com/users/JDutil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDutil/subscriptions","organizations_url":"https://api.github.com/users/JDutil/orgs","repos_url":"https://api.github.com/users/JDutil/repos","events_url":"https://api.github.com/users/JDutil/events{/privacy}","received_events_url":"https://api.github.com/users/JDutil/received_events","type":"User","site_admin":false},"created_at":"2015-08-24T22:27:27Z","updated_at":"2015-08-24T22:27:27Z","body":"Thanks"}}