RubyMoney/money — Issue #132: Keys in Money::Currency::TABLE should be string rather than symbol
Author: kenn
Created: 2011-12-14 19:48:04+00:00
State: open

In `Money::Currency#initialize`, id argument is converted to symbol in the initialize method:

```ruby
def initialize(id)
@id = id.to_s.downcase.to_sym
data = TABLE[@id] || raise(UnknownCurrency, "Unknown currency `#{id}'")
data.each_pair do |key, value|
instance_variable_set(:"@#{key}", value)
end
end
```

This could be problematic if you have a code like this in a Rails application:

```ruby
Money::Currency.new(params[:currency])

or

params[:currency].to_currency
```

This could potentially create unlimited number of symbol entry by users that eventually causes `symbol table overflow (RuntimeError)` with 16Mi entries, which could be a source of problems like memory leak, slow symbol table lookup, or even DoS attack. It statically accumulates even when it ends up with the `UnknownCurrency` exception.

FWIW, for the same reason `ActiveSupport::HashWithIndifferentAccess` keeps hash keys as string internally.

https://github.com/rails/rails/blob/master/activesupport/lib/active_support/hash_with_indifferent_access.rb

Another way to get around this is provide some validator class to check user-provided strings before the string is passed to `Money::Currency.new`.