Creating a hash of lambda's referencing instance methods in Ruby - ruby-on-rails

Question

I have a class with a hash of lambda's pointing to methods in the class.
Thing.new.call
=> undefined local variable or method `do_foo' for Thing:Class
I was expecting
Thing.new.call
=> foo
=> bar
The lambda's seem to be calling do_foo and do_bar as class methods instead of instance methods. Can I fix this? I don't want to use send(command) as the commands can be updated by a user and can be a hacking risk.
Link to a replit
class Thing
def initialize
#commands = [:foo, :bar]
end
SAFE_COMMANDS = {
foo: -> { do_foo },
bar: -> { do_bar }
}
def call
#commands.each { |command| SAFE_COMMANDS[command].call }
end
private
def do_foo
puts 'foo'
end
def do_bar
puts 'bar'
end
end

Answer 1

The problem here is your SAFE_COMMANDS array and the lambdas in it are being defined in class context, therefore it is trying to call class methods.
You can pass the instance to the lambdas so that you can call its instance methods.
class Thing
def initialize
#commands = [:foo, :bar]
end
SAFE_COMMANDS = {
foo: -> (obj){ obj.do_foo },
bar: -> (obj){ obj.do_bar }
}
def call
#commands.each { |command| SAFE_COMMANDS[command].call(self) }
end
private
def do_foo
puts 'foo'
end
def do_bar
puts 'bar'
end
end
However you'll get the following error:
private method `do_foo' called for #<Thing:0x00007fdc018399f8 #commands=[:foo, :bar]> (NoMethodError)
This is because those methods are private and therefore inaccessible by the lambdas.
So here's what I'd recommend instead. Use #send but filter the commands first and raise an exception (or something similar) if an illegal command is issued.
class Thing
def initialize
#commands = [:do_foo, :do_bar, :do_bad_stuff, :do_really_bad_stuff]
end
SAFE_COMMANDS = %i{
do_foo
do_bar
}
def call
illegal_commands = #commands - SAFE_COMMANDS
raise("illegal commands: #{illegal_commands.join(', ')}") unless illegal_commands.empty?
#commands.each { |command| self.send(command) }
end
private
def do_foo
puts 'foo'
end
def do_bar
puts 'bar'
end
end
This creates and array of any commands not in your SAFE_COMMANDS array. If that array is empty then we've only been passed legal commands and we proceed. Otherwise we raise an exception, and nicely format those illegal commands to tell the user they 'done screwed up.'
illegal commands: do_bad_stuff, do_really_bad_stuff (RuntimeError)
But I'd actually recommend checking this at initialization time. I assume you are going to eventually pass these commands to the instance somehow so I made that change.
class Thing
def initialize( *commands )
commands = commands.map(&:to_sym)
illegal_commands = commands - SAFE_COMMANDS
raise("illegal commands: #{illegal_commands.join(', ')}") unless illegal_commands.empty?
#commands = commands
end
SAFE_COMMANDS = %i{
do_foo
do_bar
}
def call
#commands.each { |command| self.send(command) }
end
private
def do_foo
puts 'foo'
end
def do_bar
puts 'bar'
end
end
# the exception is raised here
thing = Thing.new(:do_foo, :do_bar, :do_bad_stuff, :do_really_bad_stuff)
# rather than here
thing.call
I think filtering the command list rather than shenanigans with lambdas is way safer security wise, and way less complicated.