braintree/braintree_ruby_examples — Issue #2: Transparent redirect examples expose security risk
Author: luislavena
Created: 2011-12-15 22:22:35+00:00
State: open

Hello,

While looking at this file:
https://github.com/braintree/braintree_ruby_examples/blob/master/rails3_tr_devise/app/models/user.rb

Saw the usage of `user.class.send` to define methods for the returned information from Braintree

Well, that is plain wrong. To give an example:

```
>> class Profile < Struct.new(:first_name, :last_name); end
=> nil
>> luis = Profile.new("Luis", "Lavena")
=> #
>> luis.class.send(:define_method, :"first_name") { "some data" }
=> #
>> luis.first_name
=> "some data"
>> phil = Profile.new("Phil", "Collins")
=> #
>> phil.first_name
=> "some data"
```

The issue shows when more than 1 user access the braintree information. The first or last one replaces the method and that method gets accessed by other users that are just doing `find` in the model.

I suggest the example be changed to use `attr_accessor` and send on the setters:

```ruby
class User
FIELDS = [:first_name, :last_name, :phone, :website, :company, :email, :fax, :addresses, :credit_cards, :custom_fields]

attr_accessor *FIELDS

private

def retrieve_data
braintree_data = Braintree::Customer.find(braintree_customer_id)

FIELDS.each do |field|
send(:"#{field}=", braintree_data.send(field)
end
end
```