From 64658a6591f89cb0bd6c052c8d5ff093c5f2fbfe Mon Sep 17 00:00:00 2001 From: Randall Floyd Date: Thu, 5 Dec 2024 11:21:48 -0500 Subject: [PATCH] Fixing entrypoint into actor stack that casts unpermitted attributes to hash --- app/actors/hyrax/actors/environment.rb | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/app/actors/hyrax/actors/environment.rb b/app/actors/hyrax/actors/environment.rb index 5c01d5827e..5133625c64 100644 --- a/app/actors/hyrax/actors/environment.rb +++ b/app/actors/hyrax/actors/environment.rb @@ -8,7 +8,17 @@ class Environment def initialize(curation_concern, current_ability, attributes) @curation_concern = curation_concern @current_ability = current_ability - @attributes = attributes.to_h.with_indifferent_access + + # TODO: how to safely permit a variable list of attributes if we don't know them in advance? + # This is no longer allowed because keys in attributes haven't been permitted yet + # @attributes = attributes.to_h.with_indifferent_access + # + # The following would work but would permit anything found in attributes + # attributes.each_key do |key| + # attributes.permit(key.to_sym) + # end + # Or, is permit! any worse than iterating over keys? + @attributes = attributes&.permit!&.to_h&.with_indifferent_access end ##