feat(log_entry): write details unparsed and validate on read - #6530
Merged
Conversation
github-actions
Bot
added
the
changelog:solidus_core
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6530 +/- ##
=======================================
Coverage 92.14% 92.14%
=======================================
Files 1035 1035
Lines 21149 21151 +2
=======================================
+ Hits 19488 19490 +2
Misses 1661 1661 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
adammathys
approved these changes
Aug 4, 2026
tvdeyen
force-pushed
the
logentry-lazy-parse
branch
from
August 4, 2026 19:10
ba412b5 to
fb69c78
Compare
Contributor
|
Needs a manual rebase. |
mamhoff
approved these changes
Aug 6, 2026
Recording a payment response creates a Spree::LogEntry, and the log entry serialized the response through YAML.safe_dump. That validated permitted classes at write time and degraded any response it could not serialize, losing the real gateway data. The untrusted boundary is the database read, not the write of our own response, so the log entry now stores the response with a plain YAML.dump and defers the safe_load validation to when parsed_details is read. The exception behind such a fallback is now reported via Rails.error so it stays visible to developers instead of being silently swallowed.
tvdeyen
force-pushed
the
logentry-lazy-parse
branch
from
August 6, 2026 13:57
fb69c78 to
d4066c9
Compare
Member
Author
|
Done |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Recording a payment response creates a
Spree::LogEntry, and the log entry serialized the response throughYAML.safe_dump. That validated permitted classes at write time and degraded any response it could not serialize, losing the real gateway data. The untrusted boundary is the database read, not the write of our own response, so the log entry now stores the response with a plainYAML.dumpand defers thesafe_loadvalidation to whenparsed_detailsis read.The exception behind such a fallback is now reported via
Rails.errorso it stays visible to developers instead of being silently swallowed.Checklist
Check out our PR guidelines for more details.
The following are mandatory for all PRs:
The following are not always needed: