Merge branch 'update-packages' into 'master'

蔡耀賢 · 蔡耀賢 · commit a77e8cce4d68 · 2025-07-17T08:31:02.000Z
Update packages

See merge request kdanmobile/shared-code-base/gems/error_response!38
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -11,18 +11,18 @@ stages:
 
 rspec:
   stage: rspec
-  image: ruby:3.2.2
+  image: ruby:3.4.5
   tags:
     - arm64
   script:
-    - bundle install
+    - bundle install    
     - rspec spec
   only:
     - master
 
 to_gem:
   stage: publish
-  image: ruby:3.2.2
+  image: ruby:3.4.5
   tags:
     - arm64
   script:
@@ -35,4 +35,4 @@ to_gem:
     - gem build error_response.gemspec
     - gem push $GEM_NAME
   only:
-    - master
+    - /release-\d+\.\d+\.\d+(\.\d+)?/
diff --git a/.ruby-version b/.ruby-version
@@ -1 +1 @@
-3.2.2
+3.4.5
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## [1.1.5] - 2025-07-16
+- Update development_dependency.
+- Update require `active_support/concern` instead of `active_support/all`.
+- Optimize rspec test.
+- Update CI to use Ruby 3.4.5.
+- Fix Deserialization of untrusted data [CWE-502](https://cwe.mitre.org/data/definitions/502.html) by using `YAML.safe_load`.
 ## [1.1.4] - 2023-11-06
 - Update Gemfile.lock, fix Active Support security issue [CVE-2023-38037](https://github.com/advisories/GHSA-cr5q-6q9f-rq6q).
 ## [1.1.3] - 2023-05-18
diff --git a/Gemfile b/Gemfile
@@ -2,5 +2,5 @@ source 'https://rubygems.org'
 
 gemspec
 
-gem 'irb'
-gem 'rspec'
+gem 'irb', '~> 1.15.2'
+gem 'rspec', '~> 3.13.1'
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,52 +1,72 @@
 PATH
   remote: .
   specs:
-    error_response (1.1.4)
+    error_response (1.1.5)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.1.7.6)
+    activesupport (7.1.5.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
+      mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
-    concurrent-ruby (1.2.2)
-    diff-lcs (1.5.0)
-    i18n (1.14.1)
+    base64 (0.3.0)
+    benchmark (0.4.1)
+    bigdecimal (3.2.2)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.3)
+    diff-lcs (1.6.2)
+    drb (2.2.3)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    io-console (0.5.11)
-    irb (1.4.1)
-      reline (>= 0.3.0)
-    minitest (5.20.0)
-    reline (0.3.1)
+    io-console (0.8.1)
+    irb (1.15.2)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    logger (1.7.0)
+    minitest (5.25.5)
+    mutex_m (0.3.0)
+    pp (0.6.2)
+      prettyprint
+    prettyprint (0.2.0)
+    rdoc (6.3.4.1)
+    reline (0.6.1)
       io-console (~> 0.5)
-    rspec (3.11.0)
-      rspec-core (~> 3.11.0)
-      rspec-expectations (~> 3.11.0)
-      rspec-mocks (~> 3.11.0)
-    rspec-core (3.11.0)
-      rspec-support (~> 3.11.0)
-    rspec-expectations (3.11.0)
+    rspec (3.13.1)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.5)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
-    rspec-mocks (3.11.1)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
-    rspec-support (3.11.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.4)
+    securerandom (0.4.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    zeitwerk (2.6.12)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  activesupport (~> 6.1.7.6)
+  activesupport (~> 7.1.5.1)
   error_response!
-  irb
-  rspec
+  irb (~> 1.15.2)
+  rspec (~> 3.13.1, ~> 3.0)
 
 BUNDLED WITH
-   2.4.21
+   2.7.0
diff --git a/README.md b/README.md
@@ -57,23 +57,23 @@ end
 
 ### Success Response
 
-The success response is used when the request is success.
+The success response is used when the request is success. The response body is a hash with a `data` key.
 
 ```ruby
 # in controller actions
 data = { a: 1, b: 2 }
 return success_response(data) if success?
 ```
 
+> response status: 200
+> response body:
+
 ```json
 {
-  "status": 200,
-  "json": {
-    "data": {
-      "a": 1,
-      "b": 2
-    }
-  } 
+  "data": {
+    "a": 1,
+    "b": 2
+  }
 }
 ```
 
@@ -86,38 +86,34 @@ The error response is used when the request is not valid. Therefore, you need to
 return error_response(:bad_request_1) if failed?
 ```
 
+> response status: 400
+> response body:
+
 ```json
 {
-  "status": 400,
-  "json":
-    {
-      "error_code": 400001,
-      "error_message": "bad request 1",
-      "error_key": "bad_request_1",
-      "a": 1,
-      "b": 2
-    }
+  "error_code": 400_001,
+  "error_message": "bad request 1",
+  "error_key": "bad_request_1"
 }
 ```
 
-You can also provide your custom error message and error data. If error data is a hash, it will be merged into the json response; if it is an array, it will be merged into the json response with an `error_data` key.
+You can also provide your custom error message and error data. If error data is a hash, it will be merged into the json response; If it is an array, it will be merged into the json response with an `error_data` key.
 
 ```ruby
 # in controller actions
-return error_response(:bad_request_1, 'no required data', { a: 1, b: 2}) if failed?
+return error_response(:bad_request_1, 'no required data', { a: 1, b: 2 }) if failed?
 ```
 
+> response status: 400
+> response body:
+
 ```json
 {
-  "status": 400,
-  "json":
-    {
-      "error_code": 400001,
-      "error_message": "bad request 1",
-      "error_key": "bad_request_1",
-      "a": 1,
-      "b": 2
-    }
+  "error_code": 400_001,
+  "error_message": "bad request 1: no required data",
+  "error_key": "bad_request_1",
+  "a": 1,
+  "b": 2
 }
 ```
 
@@ -147,9 +143,12 @@ ErrorResponse.to_hash(:bad_request_1)
 
 gives you
 
+> response status: 400
+> response body: 
+
 ```json
 {
-  "error_code": 400001,
+  "error_code": 400_001,
   "error_message": "bad request 1",
   "error_key": "bad_request_1"
 }
diff --git a/VERSION.md b/VERSION.md
@@ -1 +1 @@
-1.1.4
+1.1.5
diff --git a/config/error_response.yml b/config/error_response.yml
@@ -1,5 +1,5 @@
 source:
   local:
-    - config/error_4xx.yml
+    - config/local_error_404.yml
   remote:
     - https://raw.githubusercontent.com/kdan-mobile-software-ltd/error_response/master/config/error_4xx.yml
diff --git a/config/local_error_404.yml b/config/local_error_404.yml
@@ -0,0 +1,3 @@
+resource_not_found:
+  error_code: 404_001
+  error_message: resource not found
diff --git a/error_response.gemspec b/error_response.gemspec
@@ -16,5 +16,6 @@ Gem::Specification.new do |s|
     "changelog_uri" => "https://github.com/kdan-mobile-software-ltd/error_response/blob/master/CHANGELOG.md"
   }
 
-  s.add_development_dependency 'activesupport', '~> 6.1.7.6'
+  s.add_development_dependency 'activesupport', '~> 7.1.5.1'
+  s.add_development_dependency 'rspec', '~> 3.0'
 end
diff --git a/lib/error_response.rb b/lib/error_response.rb
@@ -45,9 +45,9 @@ def to_api(key, message=nil)
     def yaml_hash
       return @hash unless @hash.nil?
 
-      settings = YAML.load(File.read(configuration.yaml_config_path))
+      settings = YAML.safe_load(File.read(configuration.yaml_config_path), permitted_classes: permitted_classes, aliases: true)
       local_array = settings['source']['local']
-      local_hash = local_array.nil? ? {} : local_array.map { |path| YAML.load_file(path) }.inject(&:merge)
+      local_hash = local_array.nil? ? {} : local_array.map { |path| YAML.safe_load_file(path, permitted_classes: permitted_classes, aliases: true) }.inject(&:merge)
 
       remote_array = settings['source']['remote']
       remote_hash = remote_array.nil? ? {} : remote_array.map { |url| build_yaml(url) }.inject(&:merge)
@@ -57,7 +57,7 @@ def yaml_hash
 
     def build_yaml(url)
       content = URI.open(url){|f| f.read}
-      YAML.load(content)
+      YAML.safe_load(content, permitted_classes: permitted_classes, aliases: true)
     rescue
       puts "Load yaml from URL (#{url}) failed."
       {}
@@ -76,6 +76,20 @@ def deep_dup(h)
         end
       ]}]
     end
+
+    def permitted_classes
+      [
+        Date,
+        Time,
+        Symbol,
+        Integer,
+        Float,
+        String,
+        TrueClass,
+        FalseClass,
+        NilClass
+      ]
+    end
   end
 
 end
diff --git a/lib/error_response/helper.rb b/lib/error_response/helper.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'active_support'
+require 'active_support/concern'
 
 module ErrorResponse
   module Helper
@@ -18,8 +18,11 @@ def success_response(data = {})
 
     def error_response(key, error_message = nil, error_data = {})
       render_content = ErrorResponse.to_api(key, error_message).deep_dup
-      render_content[:json].merge!(error_data) if error_data.present? && error_data.is_a?(Hash)
-      render_content[:json].merge!(error_data: error_data) if error_data.present? && error_data.is_a?(Array)
+      if error_data.is_a?(Hash) && !error_data.empty?
+        render_content[:json] = render_content[:json].merge(error_data)
+      elsif error_data.is_a?(Array) && !error_data.empty?
+        render_content[:json] = render_content[:json].merge(error_data: error_data)
+      end
       render(render_content)
     end
   end
diff --git a/spec/error_response_spec.rb b/spec/error_response_spec.rb
@@ -3,13 +3,15 @@
 RSpec.describe ErrorResponse do
   describe '#yaml_hash' do
     it 'should fetch data from local' do
-      result = ErrorResponse.to_api(:bad_request_1)
-      expect(result[:json]['error_message']).to eq 'bad request 1'
+      result = ErrorResponse.to_api(:resource_not_found)
+      expect(result[:json]['error_message']).to eq 'resource not found'
+      expect(result[:json]['error_code']).to eq 404_001
     end
 
     it 'should fetch data from remote' do
       result = ErrorResponse.to_api(:bad_request_2)
       expect(result[:json]['error_message']).to eq 'bad request 2'
+      expect(result[:json]['error_code']).to eq 400_002
     end
   end
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+resource_not_found:`
	`2`	`+ error_code: 404_001`
	`3`	`+ error_message: resource not found`
Original file line number	Diff line number	Diff line change
`@@ -16,5 +16,6 @@ Gem::Specification.new do \|s\|`
`16`	`16`	`"changelog_uri" => "https://github.com/kdan-mobile-software-ltd/error_response/blob/master/CHANGELOG.md"`
`17`	`17`	`}`
`18`	`18`
`19`		`- s.add_development_dependency 'activesupport', '~> 6.1.7.6'`
	`19`	`+ s.add_development_dependency 'activesupport', '~> 7.1.5.1'`
	`20`	`+ s.add_development_dependency 'rspec', '~> 3.0'`
`20`	`21`	`end`