Require explict allowlisting of attributes and associations

[deivid-rodriguez]

Fixes #1273.

[deivid-rodriguez]

@scarroll32 Ok with releasing this as Ransack 4.0?

[lukas-eu]

A typo and another idea for naming the list of all attributes/associations

[deivid-rodriguez]

I will prepare a release tomorrow.

[deivid-rodriguez]

@scarroll32 I created a release draft. It's been a while without releases, so let me know how it looks if you have some time! Otherwise I'll just release this tommorrow™️.

[scarroll32]

References

• https://positive.security/blog/ransack-data-exfiltration
• https://portswigger.net/daily-swig/ruby-on-rails-apps-vulnerable-to-data-theft-through-ransack-search

[AndreyCerqueiraLima]

I really understood the security idea about this change.

But when something doesn't have a door the path is "free".
When you put a door on the path and force every player to implement a key to use this door, everything is okay when this door is just for 2 people.

However, when all of the world need to use this door, you generate a big problem! Imagine, need to generate a key for everyone.

So, this behavior break so many applications that discourages people use ransack. Because the core changed and break the whole app, forced to implement this security feature.