This project is archived and is in readonly mode.
ActiveResource breaks when encounters <object> tag in XML
-
CancelProfileIsBroken
- Tag changed from 2.3, activeresource, bug to 2.3, activeresource, bug, bugmash
-
Dan Pickett
verified
-1 on this - I think accommodating the object element will lead to lots of special handling
From an XML perspective as well, it's not very descriptive of the "object" it's referring to - it should be renamed
-
Maxim Chernyak
Rails produces an obscure error for certain completely valid xml. Isn't it worth it to at least throw a better message saying "sorry but tag is not allowed in rails"? What about legacy XML or generic interfaces where IS intended for generic use?
Besides it's creepy that I can get someone's rails app to execute Object.new by simply sending some xml. You don't always know what you're getting.
-
Peer Allan
I have to agree with both Dan and Maxim in this case (can I do that?). I don't like the idea of adding special, possibly hardcoded, handling into this. However is it creepy think that someone posting some XML with can get the app to execute the Object.new.
That said, a reserved work list for the XML generator may be the way to get around this. If, at minimum, the reserved words throw a useful error back to the user.
-
hsume2 (Henry)
verified on master and 2-3-stable
I've attached a patch; failing test for master (cherry picks into 2-3-stable) as well a patch for 2-3-stable.
-
hsume2 (Henry)
sorry, changed
addresstoobject -
Elomar França
Verified the bug, but I do not agree with the hardcoded solution.
I think it would be better to have some kind of reserved words list, as Peer Allan proposed. Is it possible and desirable (but I think it isn't) to "unload" some constants, as Object, before loading the XML?
-
Elad Meidar
+1 Verified, but i am too not very fond of the hard-code solution. I agree with Dan and Elomar, that Object should be left alone and a more descriptive name should be used ( + a reserved words list )
-
hsume2 (Henry)
+1 for reserved words list, especially for the case of nested, existing resources, since we wouldn't want anyone doing:
class Object < ActiveResource::Base end -
Maxim Chernyak
IMO, when dealing with APIs it's important to keep in mind flexible input -> exact output principle. Object tag may appear on a more specific level, you know. It's a widely used english word after all. For example:
<game> <title>Paintball</title> <object>Kill everyone</object> <rules>...</rules> </game>I'm sure Game.new.object is not the only example.
-
Elad Meidar
@Maxim: correct, but stilll Game.new.objective is a much more clear / safe phrase to use.
-
Rizwan Reza
- Tag changed from 2.3, activeresource, bug, bugmash to 2.3, activeresource, bug
-
Santiago Pastorino
- State changed from new to open
- Tag changed from 2.3, activeresource, bug to 23, activeresource, bug
- Importance changed from to
This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.
Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.
-
Santiago Pastorino
- State changed from open to stale
