feat(log_entry): write details unparsed and validate on read - #6530
Open
tvdeyen wants to merge 1 commit into
Open
feat(log_entry): write details unparsed and validate on read#6530tvdeyen wants to merge 1 commit into
tvdeyen wants to merge 1 commit into
Conversation
Recording a payment response creates a Spree::LogEntry, and the log entry serialized the response through YAML.safe_dump. That validated permitted classes at write time and degraded any response it could not serialize, losing the real gateway data. The untrusted boundary is the database read, not the write of our own response, so the log entry now stores the response with a plain YAML.dump and defers the safe_load validation to when parsed_details is read. The exception behind such a fallback is now reported via Rails.error so it stays visible to developers instead of being silently swallowed.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6530 +/- ##
==========================================
+ Coverage 89.66% 92.38% +2.71%
==========================================
Files 990 42 -948
Lines 20792 788 -20004
==========================================
- Hits 18644 728 -17916
+ Misses 2148 60 -2088 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Recording a payment response creates a
Spree::LogEntry, and the log entry serialized the response throughYAML.safe_dump. That validated permitted classes at write time and degraded any response it could not serialize, losing the real gateway data. The untrusted boundary is the database read, not the write of our own response, so the log entry now stores the response with a plainYAML.dumpand defers thesafe_loadvalidation to whenparsed_detailsis read.The exception behind such a fallback is now reported via
Rails.errorso it stays visible to developers instead of being silently swallowed.Checklist
Check out our PR guidelines for more details.
The following are mandatory for all PRs:
The following are not always needed: