Mint the tampered sgid without extending a Room

The invalid-sgid test made one live Room attachable — `rooms(:pets).tap
{ |r| r.extend ActionText::Attachable }` — only to call
`attachable_sgid` on it. That method is `to_sgid(expires_in: nil,
for: ActionText::Attachable::LOCATOR_NAME).to_s`, so the test can mint
the same sgid directly and drop the per-instance extend; the assertion
(a signature that does not verify resolves to MissingAttachable) is
unchanged, and so are the bytes it tampers with.
This commit is contained in:
Sam Ruby
2026-09-20 11:19:14 -04:00
parent 977cbcd135
commit 0ed0af44ef
2 changed files with 5 additions and 4 deletions
+1
View File
@@ -174,6 +174,7 @@ GEM
erubi (1.13.1)
faker (3.5.2)
i18n (>= 1.8.11, < 2)
ffi (1.17.2)
ffi (1.17.2-aarch64-linux-gnu)
ffi (1.17.2-arm64-darwin)
ffi (1.17.2-x86_64-darwin)
+4 -4
View File
@@ -24,10 +24,10 @@ class ActionTextAttachmentTest < ActiveSupport::TestCase
end
test "lookup invalid sgid for an attachable requiring a valid sgid" do
# Make room instance attachable for testing purposes
room = rooms(:pets).tap { |r| r.extend ActionText::Attachable }
message, signature = rooms(:pets).attachable_sgid.split("--")
# A Room is not attachable; mint the sgid an attachable would carry
# (`ActionText::Attachable#attachable_sgid` is exactly this call) so
# the lookup is exercised on a signature that does not verify.
message, signature = rooms(:pets).to_sgid(expires_in: nil, for: ActionText::Attachable::LOCATOR_NAME).to_s.split("--")
html = %Q(<action-text-attachment sgid="#{message}--invalid"></action-text-attachment>)
node = ActionText::Fragment.wrap(html).find_all(ActionText::Attachment.tag_name).first