Remove eval from remote_census_api
The use of eval is a serious security risk, so we change by JSON.parse method
This commit is contained in:
@@ -84,7 +84,7 @@ class RemoteCensusApi
|
||||
end
|
||||
|
||||
def request(document_type, document_number, date_of_birth, postal_code)
|
||||
structure = eval(Setting["remote_census.request.structure"])
|
||||
structure = JSON.parse(Setting["remote_census.request.structure"])
|
||||
|
||||
fill_in(structure, Setting["remote_census.request.document_type"], document_type)
|
||||
fill_in(structure, Setting["remote_census.request.document_number"], document_number)
|
||||
@@ -100,12 +100,11 @@ class RemoteCensusApi
|
||||
|
||||
def fill_in(structure, path_value, value)
|
||||
path = parse_path(path_value)
|
||||
|
||||
update_value(structure, path, value) if path.present?
|
||||
end
|
||||
|
||||
def parse_path(path_value)
|
||||
path_value.split(".").map { |section| section.to_sym } if path_value.present?
|
||||
path_value.split(".") if path_value.present?
|
||||
end
|
||||
|
||||
def update_value(structure, path, value)
|
||||
|
||||
Reference in New Issue
Block a user