Ruby & Rails - Convert String to Proc

Question

I'm in the following situation. The current url looks like the following:

/categories/Art

And I'm using name = location.pathname.split('/')[2] in order to grab the Art portion of the URL. Then, I send an AJAX the following path back to the controller: http://localhost:3000/sort?sortMethod=name&category=name or date, whichever link is clicked on.

Now in my controller I can use sort = params[:category] to get the string name, yet what I'd like to do with this string is sort an array by it. @categories is an array of objects and I'd like to call .sort_by(&:sort) yet it doesn't recognize the string value of sort = name. So now I'd like to convert this string into a proc in order to sort the array. Anyone know how I accomplish this?

Any help is greatly appreciated!

Jakub Hampl · Accepted Answer · 2011-03-13 14:40:14Z

2

Convert it to a symbol first and then use Symbol#to_proc:

@categories.sort_by(&sort.to_sym)

However be sure that the users can't call anything malicious on your objects like:

http://localhost:3000/sort?sortMethod=destroy

One way of protecting yourself is to use attribute_accessible definitions in your model and then do

@categories.sort_by(&sort.to_sym) if Category.accessible_attributes.include? sort.to_sym

edited Mar 13, 2011 at 14:40

answered Mar 13, 2011 at 14:24

Jakub Hampl

40.7k10 gold badges80 silver badges111 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Matt Over a year ago

How would you recommend I go about protecting myself from that? What are some common approaches to a similar situation?

Mike Lewis Over a year ago

Have a list of whitelisted methods. Do some like this: sort_by(&sort.to_sym) if whitelist.include?(sort)

Jakub Hampl Over a year ago

I've added an example specific for ActiveRecord, but you can have a whitelist for any object.

Ajedi32 Over a year ago

Fyi, this method opens you up to a specific kind of DOS attack: tricksonrails.com/2010/06/… You may want to consider checking whether the attribute is accessible BEFORE converting the user input to a symbol.

Alberto Santini · Accepted Answer · 2011-03-13 14:29:59Z

0

The problem is not entirely clear, so you may need to adjust the following solution. However, the basic idea is taht it's possible to do something like:

Category.all.sort_by {|category| category.method(params[:category]).call }

answered Mar 13, 2011 at 14:29

Alberto Santini

6,5821 gold badge28 silver badges39 bronze badges

1 Comment

Alberto Santini Over a year ago

While I was writing also Jakub answered. I think both solutions work; his solution is a shorthand to this one and could be preferred. Use mine if you need to be a little more flexible, e.g. if you want to handle errors whenever params[:category] contains a string that is not an instance method of Category (what happens if a user requests ...?sortMethod=a_method_that_does_not_exist or ...?sortMethod=destroy?)

fengolly · Accepted Answer · 2011-03-13 19:23:12Z

0

Also, the "Art" portion of your url is available in Rails' params hash as params[:action], so you don't have to do location.pathname.split('/')[2].

answered Mar 13, 2011 at 19:23

fengolly

5033 silver badges8 bronze badges

1 Comment

Matt Over a year ago

I need to grab it in the javascript function, not the rails controller.

Collectives™ on Stack Overflow

Ruby & Rails - Convert String to Proc

3 Answers 3

4 Comments

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related