My code: job = param[:worker_name].constantize.get_meta(params[:key]) I when I use brakeman I see error Unsafe reflection method constantize called with parameter value How to fix it
What Brakeman is trying to warn you about is that anyone could pass in a goofy class name and there would be the attempt to #constantize that class. So if you had, say, three possible workers that could be provided, you could allow only these by hard coding things something like this:
job = case param[:worker_name]
when 'Ascending'
Ascending
when 'Descending'
Descending
when 'Unordered'
Unordered
end.get_meta(params[:key])
Then if someone passed in GoofyClass it would not be attempted. Although the above is not as DRY as your existing code, thankfully no one can try hacking things or load up tons of classes in an attempt to slow your server down.
how can I get all worker class, I use resque gem for job GitHub - resque/resque: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later.
Oh! You might be using the resque-meta gem which extends Resque. If so then try doing this:
job = Resque::Plugins::Meta.get_meta(params[:key])
And if that doesn’t work then a little more goofy, and perhaps more of a long shot, but you could try:
job = Resque::Plugins::Meta::Metadata.new(Resque.decode(Resque.redis.get("meta:#{params[:key]}")))
Why do You can use Meta.get_meta. Please show document for this syntax. I cannot find anything for this
When I try run Meta.get_meta in console I get error uninitialized constant Meta
Do you use Skype, Please help me, thank you very much! My task is urgent
Heya! Have just had my morning coffee and saw your note. Started up a Google Hangouts session and have sent you the link.
So after going through things, in your job class make sure the @queue instance variable is set, something like:
class MyJob
extend Resque::Plugins::Meta
@queue = :my_worker_queue
end
Then we can enqueue a job:
x = MyJob.enqueue('hello')
and then you should be able to reference the metadata for a queued job:
Resque::Plugins::Meta.get_meta(x.meta_id)
When I run the above inside of a rails c then here’s what it looks like on my machine:
Yes, I see. Thank you very much!
1 Like
Can you help me, I have one issue and Cannot fix them
