search

varvet / pundit

Minimal authorization through OO design and pure Ruby classes
MIT License
8.22k stars 625 forks source link

Require users to explicitly define Scope#resolve #722

Closed Burgestrand closed 2 years ago

Burgestrand commented 2 years ago

Closes https://github.com/varvet/pundit/pull/711 (original issue and pull request)

A01:2021-Broken Access Control is the category with the most serious web application security risk.

Using scope.all in templates violates the principle of least privilege or deny by default, where access should only be granted for particular capabilities, roles, or users.

This change improves the security of default templates

Ref: https://owasp.org/Top10/A01_2021-Broken_Access_Control/ — by @tagliala (github.com/tagliala)