• A
    Omit marshal_dump & _dump from delegate_missing_to · 056414eb
    Aaron Lipman 提交于
    Exclude missing marshal_dump and _dump methods from being delegated to
    an object's delegation target via the delegate_missing_to extension.
    This avoids unintentionally adding instance variables to an object
    during marshallization, should the delegation target be a method which
    would otherwise add them.
    
    In current versions of Ruby, a bug exists in the way objects are
    marshalled, allowing for instance variables to be added or removed
    during marshallization (see https://bugs.ruby-lang.org/issues/15968).
    This results in a corrupted serialized byte stream, causing an object's
    instance variables to "leak" into subsequent serialized objects during
    demarshallization.
    
    In Rails, this behavior may be triggered when marshalling an object that
    uses the delegate_missing_to extension, if the delegation target is a
    method which adds or removes instance variables to an object being
    marshalled - when calling Marshal.dump(object), Ruby's built in behavior
    will check whether the object responds to :marshal_dump or :_dump, which
    in turn triggers the delegation target method in the
    responds_to_missing? function defined in
    activesupport/lib/active_support/core_ext/module/delegation.rb
    
    While future versions of Ruby will resolve this bug by raising a
    RuntimeError, the underlying cause of this error may not be readily
    apparent when encountered by Rails developers. By excluding marshal_dump
    and _dump from being delegated to an object's target, this commit
    eliminates a potential cause of unexpected behavior and/or
    RuntimeErrors.
    
    Fixes #36522
    056414eb
可在Tags中查看这些版本中当前仓库的状态.
CHANGELOG.md 15.9 KB