Skip to content

Commit e17c3f1

Browse files
committed
Don't show secrets for SignedGlobalID#inspect
If anyone calls `to_sgid` on a model in the console it will show the secret of the encryptor. By overriding the `inspect` method to only show the class name we can avoid accidentally outputting sensitive information. Before: ```ruby SignedGlobalID.create(Person.new(5)).inspect "#<SignedGlobalID:0x0000000104888038 ... @secret=\"muchSECRETsoHIDDEN\ ... >" ``` After: ```ruby SignedGlobalID.create(Person.new(5)).inspect "#<SignedGlobalID:0x0000000104888038>" ```
1 parent fe4249a commit e17c3f1

File tree

2 files changed

+8
-0
lines changed

2 files changed

+8
-0
lines changed

lib/global_id/signed_global_id.rb

+4
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ def ==(other)
7272
super && @purpose == other.purpose
7373
end
7474

75+
def inspect # :nodoc:
76+
"#<#{self.class.name}:#{'%#016x' % (object_id << 1)}>"
77+
end
78+
7579
private
7680
def pick_expiration(options)
7781
return options[:expires_at] if options.key?(:expires_at)

test/cases/signed_global_id_test.rb

+4
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ class SignedGlobalIDTest < ActiveSupport::TestCase
2929
test 'to param' do
3030
assert_equal @person_sgid.to_s, @person_sgid.to_param
3131
end
32+
33+
test 'inspect' do
34+
assert_match(/\A#<SignedGlobalID:0x[0-9a-f]+>\z/, @person_sgid.inspect)
35+
end
3236
end
3337

3438
class SignedGlobalIDPurposeTest < ActiveSupport::TestCase

0 commit comments

Comments
 (0)