{"action":"created","comment":{"url":"https://api.github.com/repos/theforeman/foreman/pulls/comments/37190970","id":37190970,"diff_hunk":"@@ -15,4 +15,35 @@ def set_timezone\n     # Reset timezone for the next thread\n     Time.zone = default_timezone\n   end\n-end\n\\ No newline at end of file\n+\n+  private\n+\n+  # Get the allowed parameters from the Apipie documentation in the API controllers.\n+  def safe_params\n+    apipie_params = Apipie.app.get_method_description(\"v2##{controller_name}\", action_name).to_json[:params]\n+    model_api_description = apipie_params.find { |param| param[:name] == controller_name.singularize }\n+    params.require(controller_name.singularize.to_sym).\n+      permit(*safe_attributes_from_api_description(model_api_description))\n+  end\n+\n+  def safe_attributes_from_api_description(model_api_description)\n+    model_api_description[:params].map do |param|\n+      if param_group?(param)\n+        { param[:name].to_sym => build_safe_params(param[:params]) }","path":"app/controllers/concerns/application_shared.rb","position":20,"original_position":20,"commit_id":"76e3ae85bc9b315d2a6375bd2d3b3b6d83a76145","original_commit_id":"76e3ae85bc9b315d2a6375bd2d3b3b6d83a76145","user":{"login":"unorthodoxgeek","id":706359,"avatar_url":"https://avatars.githubusercontent.com/u/706359?v=3","gravatar_id":"","url":"https://api.github.com/users/unorthodoxgeek","html_url":"https://github.com/unorthodoxgeek","followers_url":"https://api.github.com/users/unorthodoxgeek/followers","following_url":"https://api.github.com/users/unorthodoxgeek/following{/other_user}","gists_url":"https://api.github.com/users/unorthodoxgeek/gists{/gist_id}","starred_url":"https://api.github.com/users/unorthodoxgeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/unorthodoxgeek/subscriptions","organizations_url":"https://api.github.com/users/unorthodoxgeek/orgs","repos_url":"https://api.github.com/users/unorthodoxgeek/repos","events_url":"https://api.github.com/users/unorthodoxgeek/events{/privacy}","received_events_url":"https://api.github.com/users/unorthodoxgeek/received_events","type":"User","site_admin":false},"body":"this allows for an attack exploiting Ruby's lack of GC on symbols\r\njust loop requests with different unique params[:name], slowly but surely, memory consumption goes up until Ruby process goes down.","created_at":"2015-08-17T14:12:31Z","updated_at":"2015-08-17T14:12:31Z","html_url":"https://github.com/theforeman/foreman/pull/2509#discussion_r37190970","pull_request_url":"https://api.github.com/repos/theforeman/foreman/pulls/2509","_links":{"self":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/comments/37190970"},"html":{"href":"https://github.com/theforeman/foreman/pull/2509#discussion_r37190970"},"pull_request":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/2509"}}},"pull_request":{"url":"https://api.github.com/repos/theforeman/foreman/pulls/2509","id":39047146,"html_url":"https://github.com/theforeman/foreman/pull/2509","diff_url":"https://github.com/theforeman/foreman/pull/2509.diff","patch_url":"https://github.com/theforeman/foreman/pull/2509.patch","issue_url":"https://api.github.com/repos/theforeman/foreman/issues/2509","number":2509,"state":"open","locked":false,"title":"Refs #3917 - Enable strong_params (Puppetclass and generic)","user":{"login":"eLobato","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/eLobato","html_url":"https://github.com/eLobato","followers_url":"https://api.github.com/users/eLobato/followers","following_url":"https://api.github.com/users/eLobato/following{/other_user}","gists_url":"https://api.github.com/users/eLobato/gists{/gist_id}","starred_url":"https://api.github.com/users/eLobato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eLobato/subscriptions","organizations_url":"https://api.github.com/users/eLobato/orgs","repos_url":"https://api.github.com/users/eLobato/repos","events_url":"https://api.github.com/users/eLobato/events{/privacy}","received_events_url":"https://api.github.com/users/eLobato/received_events","type":"User","site_admin":false},"body":"The idea of this PR is to start enabling strong_params in one class, and provide a minimal avenue, `method_missing`, to allow any class to define it's permitted attributes in the model. We could possibly even just read the Apipie docs and permit these attributes.\r\n\r\nIf I'm not wrong, this should allow us to follow this path:\r\n\r\n1. Enable this in as many classes as we can without breaking plugins. I started with Puppetclass as it has almost no `belongs_to` relations and I don't know any plugin that uses it.\r\n2. When the only classes remaining are the ones that plugins utilize (Host, Hostgroup, etc..) we can work together with plugins to improve this. \r\n3. It allows plugin owners to start making their own controllers Rails 4 ready before the migration.\r\n4. When we migrate to Rails 4, at a bare minimum we would have done all our homework regarding params if steps 1,2,3 have been completed.\r\n\r\nWe can also move in almost all testing changes from the [Rails 4 big PR](https://github.com/theforeman/foreman/pull/2055) as a trivial next step as well.\r\n\r\nBasically @shlomizadok 's [PR](https://github.com/theforeman/foreman/pull/1819/files) but I'm trying to keep permitted attributes in their own classes rather than a central file.\r\n\r\n@unorthodoxgeek thoughts?","created_at":"2015-07-02T04:17:20Z","updated_at":"2015-08-17T14:12:31Z","closed_at":null,"merged_at":null,"merge_commit_sha":"744631fd98ab91790cd67683a4035f6a56e08c91","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/theforeman/foreman/pulls/2509/commits","review_comments_url":"https://api.github.com/repos/theforeman/foreman/pulls/2509/comments","review_comment_url":"https://api.github.com/repos/theforeman/foreman/pulls/comments{/number}","comments_url":"https://api.github.com/repos/theforeman/foreman/issues/2509/comments","statuses_url":"https://api.github.com/repos/theforeman/foreman/statuses/76e3ae85bc9b315d2a6375bd2d3b3b6d83a76145","head":{"label":"eLobato:3917","ref":"3917","sha":"76e3ae85bc9b315d2a6375bd2d3b3b6d83a76145","user":{"login":"eLobato","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/eLobato","html_url":"https://github.com/eLobato","followers_url":"https://api.github.com/users/eLobato/followers","following_url":"https://api.github.com/users/eLobato/following{/other_user}","gists_url":"https://api.github.com/users/eLobato/gists{/gist_id}","starred_url":"https://api.github.com/users/eLobato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eLobato/subscriptions","organizations_url":"https://api.github.com/users/eLobato/orgs","repos_url":"https://api.github.com/users/eLobato/repos","events_url":"https://api.github.com/users/eLobato/events{/privacy}","received_events_url":"https://api.github.com/users/eLobato/received_events","type":"User","site_admin":false},"repo":{"id":5842097,"name":"foreman","full_name":"eLobato/foreman","owner":{"login":"eLobato","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/eLobato","html_url":"https://github.com/eLobato","followers_url":"https://api.github.com/users/eLobato/followers","following_url":"https://api.github.com/users/eLobato/following{/other_user}","gists_url":"https://api.github.com/users/eLobato/gists{/gist_id}","starred_url":"https://api.github.com/users/eLobato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eLobato/subscriptions","organizations_url":"https://api.github.com/users/eLobato/orgs","repos_url":"https://api.github.com/users/eLobato/repos","events_url":"https://api.github.com/users/eLobato/events{/privacy}","received_events_url":"https://api.github.com/users/eLobato/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/eLobato/foreman","description":"an application that automates the lifecycle of servers ","fork":true,"url":"https://api.github.com/repos/eLobato/foreman","forks_url":"https://api.github.com/repos/eLobato/foreman/forks","keys_url":"https://api.github.com/repos/eLobato/foreman/keys{/key_id}","collaborators_url":"https://api.github.com/repos/eLobato/foreman/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/eLobato/foreman/teams","hooks_url":"https://api.github.com/repos/eLobato/foreman/hooks","issue_events_url":"https://api.github.com/repos/eLobato/foreman/issues/events{/number}","events_url":"https://api.github.com/repos/eLobato/foreman/events","assignees_url":"https://api.github.com/repos/eLobato/foreman/assignees{/user}","branches_url":"https://api.github.com/repos/eLobato/foreman/branches{/branch}","tags_url":"https://api.github.com/repos/eLobato/foreman/tags","blobs_url":"https://api.github.com/repos/eLobato/foreman/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/eLobato/foreman/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/eLobato/foreman/git/refs{/sha}","trees_url":"https://api.github.com/repos/eLobato/foreman/git/trees{/sha}","statuses_url":"https://api.github.com/repos/eLobato/foreman/statuses/{sha}","languages_url":"https://api.github.com/repos/eLobato/foreman/languages","stargazers_url":"https://api.github.com/repos/eLobato/foreman/stargazers","contributors_url":"https://api.github.com/repos/eLobato/foreman/contributors","subscribers_url":"https://api.github.com/repos/eLobato/foreman/subscribers","subscription_url":"https://api.github.com/repos/eLobato/foreman/subscription","commits_url":"https://api.github.com/repos/eLobato/foreman/commits{/sha}","git_commits_url":"https://api.github.com/repos/eLobato/foreman/git/commits{/sha}","comments_url":"https://api.github.com/repos/eLobato/foreman/comments{/number}","issue_comment_url":"https://api.github.com/repos/eLobato/foreman/issues/comments{/number}","contents_url":"https://api.github.com/repos/eLobato/foreman/contents/{+path}","compare_url":"https://api.github.com/repos/eLobato/foreman/compare/{base}...{head}","merges_url":"https://api.github.com/repos/eLobato/foreman/merges","archive_url":"https://api.github.com/repos/eLobato/foreman/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/eLobato/foreman/downloads","issues_url":"https://api.github.com/repos/eLobato/foreman/issues{/number}","pulls_url":"https://api.github.com/repos/eLobato/foreman/pulls{/number}","milestones_url":"https://api.github.com/repos/eLobato/foreman/milestones{/number}","notifications_url":"https://api.github.com/repos/eLobato/foreman/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/eLobato/foreman/labels{/name}","releases_url":"https://api.github.com/repos/eLobato/foreman/releases{/id}","created_at":"2012-09-17T14:23:49Z","updated_at":"2015-05-06T16:17:15Z","pushed_at":"2015-08-17T13:56:00Z","git_url":"git://github.com/eLobato/foreman.git","ssh_url":"git@github.com:eLobato/foreman.git","clone_url":"https://github.com/eLobato/foreman.git","svn_url":"https://github.com/eLobato/foreman","homepage":"http://theforeman.org","size":31835,"stargazers_count":1,"watchers_count":1,"language":"Ruby","has_issues":false,"has_downloads":false,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":2,"forks":0,"open_issues":2,"watchers":1,"default_branch":"develop"}},"base":{"label":"theforeman:develop","ref":"develop","sha":"8caf49dbe303f791b8bde3065aae535601d959f0","user":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"repo":{"id":258750,"name":"foreman","full_name":"theforeman/foreman","owner":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/theforeman/foreman","description":"an application that automates the lifecycle of servers ","fork":false,"url":"https://api.github.com/repos/theforeman/foreman","forks_url":"https://api.github.com/repos/theforeman/foreman/forks","keys_url":"https://api.github.com/repos/theforeman/foreman/keys{/key_id}","collaborators_url":"https://api.github.com/repos/theforeman/foreman/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/theforeman/foreman/teams","hooks_url":"https://api.github.com/repos/theforeman/foreman/hooks","issue_events_url":"https://api.github.com/repos/theforeman/foreman/issues/events{/number}","events_url":"https://api.github.com/repos/theforeman/foreman/events","assignees_url":"https://api.github.com/repos/theforeman/foreman/assignees{/user}","branches_url":"https://api.github.com/repos/theforeman/foreman/branches{/branch}","tags_url":"https://api.github.com/repos/theforeman/foreman/tags","blobs_url":"https://api.github.com/repos/theforeman/foreman/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/theforeman/foreman/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/theforeman/foreman/git/refs{/sha}","trees_url":"https://api.github.com/repos/theforeman/foreman/git/trees{/sha}","statuses_url":"https://api.github.com/repos/theforeman/foreman/statuses/{sha}","languages_url":"https://api.github.com/repos/theforeman/foreman/languages","stargazers_url":"https://api.github.com/repos/theforeman/foreman/stargazers","contributors_url":"https://api.github.com/repos/theforeman/foreman/contributors","subscribers_url":"https://api.github.com/repos/theforeman/foreman/subscribers","subscription_url":"https://api.github.com/repos/theforeman/foreman/subscription","commits_url":"https://api.github.com/repos/theforeman/foreman/commits{/sha}","git_commits_url":"https://api.github.com/repos/theforeman/foreman/git/commits{/sha}","comments_url":"https://api.github.com/repos/theforeman/foreman/comments{/number}","issue_comment_url":"https://api.github.com/repos/theforeman/foreman/issues/comments{/number}","contents_url":"https://api.github.com/repos/theforeman/foreman/contents/{+path}","compare_url":"https://api.github.com/repos/theforeman/foreman/compare/{base}...{head}","merges_url":"https://api.github.com/repos/theforeman/foreman/merges","archive_url":"https://api.github.com/repos/theforeman/foreman/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/theforeman/foreman/downloads","issues_url":"https://api.github.com/repos/theforeman/foreman/issues{/number}","pulls_url":"https://api.github.com/repos/theforeman/foreman/pulls{/number}","milestones_url":"https://api.github.com/repos/theforeman/foreman/milestones{/number}","notifications_url":"https://api.github.com/repos/theforeman/foreman/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/theforeman/foreman/labels{/name}","releases_url":"https://api.github.com/repos/theforeman/foreman/releases{/id}","created_at":"2009-07-23T15:07:00Z","updated_at":"2015-08-15T19:42:29Z","pushed_at":"2015-08-17T13:56:02Z","git_url":"git://github.com/theforeman/foreman.git","ssh_url":"git@github.com:theforeman/foreman.git","clone_url":"https://github.com/theforeman/foreman.git","svn_url":"https://github.com/theforeman/foreman","homepage":"http://theforeman.org","size":85515,"stargazers_count":826,"watchers_count":826,"language":"Ruby","has_issues":false,"has_downloads":false,"has_wiki":false,"has_pages":false,"forks_count":423,"mirror_url":null,"open_issues_count":87,"forks":423,"open_issues":87,"watchers":826,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/2509"},"html":{"href":"https://github.com/theforeman/foreman/pull/2509"},"issue":{"href":"https://api.github.com/repos/theforeman/foreman/issues/2509"},"comments":{"href":"https://api.github.com/repos/theforeman/foreman/issues/2509/comments"},"review_comments":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/2509/comments"},"review_comment":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/theforeman/foreman/pulls/2509/commits"},"statuses":{"href":"https://api.github.com/repos/theforeman/foreman/statuses/76e3ae85bc9b315d2a6375bd2d3b3b6d83a76145"}}}}