From ec614e17a2db7115ce3b59a0fbbc41607d18d63c Mon Sep 17 00:00:00 2001 From: Sojan Date: Wed, 12 Mar 2025 01:59:05 -0700 Subject: [PATCH] chore: another fix --- app/models/installation_config.rb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/models/installation_config.rb b/app/models/installation_config.rb index cedabd073..879442d71 100644 --- a/app/models/installation_config.rb +++ b/app/models/installation_config.rb @@ -19,6 +19,11 @@ class InstallationConfig < ApplicationRecord # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 # FIX ME : fixes breakage of installation config. we need to migrate. # Fix configuration in application.rb + # + # Note: This whole thing is because we store the installation config serialized in YAML in Database + # This serialized version stores HashWithIndifferentAccess, We could avoid all this complexity if we store the value as JSONB + # We could also avoid this issue if we migrate the installation config to JSONB + # We should do this migration at some point in time. serialize :serialized_value, coder: YAML, type: ActiveSupport::HashWithIndifferentAccess before_validation :set_lock @@ -32,6 +37,10 @@ class InstallationConfig < ApplicationRecord after_commit :clear_cache def value + # This is an extra hack again cause of the YAML serialization, in case of new object initialization in super admin + # It was throwing error as the default value of column '{}' was failing in deserialization. + return {}.with_indifferent_access if new_record? && @attributes['serialized_value']&.value_before_type_cast == '{}' + serialized_value[:value] end