Potential fix for code scanning alert no. 29: Code injection

[RajeshPaul38]

Potential fix for https://github.com/chef/supermarket/security/code-scanning/29

The root problem is allowing user-controlled input to be dynamically constantized into a class name using constantize, which can lead to code injection. Instead, the solution is to create a static mapping of the permitted resource types ("Cookbook" and "Tool") to their respective classes. We replace

resource = collaborator_params[:resourceable_type].constantize.find(
  collaborator_params[:resourceable_id]
)

with a safe mapping, e.g.:

RESOURCEABLE_MODELS = {
  "Cookbook" => Cookbook,
  "Tool" => Tool
}

resourceable_klass = RESOURCEABLE_MODELS[collaborator_params[:resourceable_type]]
resource = resourceable_klass.find(collaborator_params[:resourceable_id])

This eliminates dynamic constantization. Also, ensure this mapping is defined in the same class or as a private constant.

The only file to modify is src/supermarket/app/controllers/collaborators_controller.rb, in the create action (lines 34-52).

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a code injection security vulnerability (Alert #29) by replacing dynamic constantization with a safe static mapping. The change prevents potential code injection attacks that could occur when user-controlled input is passed to Ruby's constantize method.

• Replaces constantize call with a static mapping of permitted resource types
• Changes validation logic from array inclusion to hash key lookup
• Eliminates the security risk of arbitrary class instantiation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The constant RESOURCEABLE_MODELS should be defined at the class level rather than inside the method. Constants defined within method scope are recreated on every method call, which is inefficient and goes against Ruby conventions. Move this constant outside the method definition.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud