Skip to content

Make method_missing private#614

Merged
rafaelfranca merged 1 commit into
rails:mainfrom
alexceder:make-method-missing-private
May 15, 2026
Merged

Make method_missing private#614
rafaelfranca merged 1 commit into
rails:mainfrom
alexceder:make-method-missing-private

Conversation

@alexceder

Copy link
Copy Markdown
Contributor

alias_method :method_missing, :set! was placed after the private directive, but alias_method does not respect the modifier, it copies the visibility of the source method. Since #set! is public, the alias silently made method_missing public, overriding the private one inherited from BasicObject.

Add an explicit private :method_missing after the alias (above the private directive, for clarity) so that #method_missing is properly private.

As a side effect, json.method_missing "hello" now reaches #set! with both a key and a value set!(:method_missing, "hello"), like any other DSL call, and produces {"method_missing": "hello"}. Before this patch the public alias was called directly as set!("hello"), a single-arg call that was silently dropped because _set_value short-circuits on a BLANK value, so the key never appeared in the output at all.

Discovered by accident while migrating a Rails app to Jbuilder, where an object happened to expose method_missing as a key and produced unexpected output.

`alias_method :method_missing, :set!` was placed after the `private`
directive, but `alias_method` does not respect the modifier, it copies
the visibility of the source method. Since `#set!` is public, the alias
silently made `method_missing` public, overriding the private one
inherited from `BasicObject`.

Add an explicit `private :method_missing` after the alias (above the
`private` directive, for clarity) so that `#method_missing` is properly
private.

As a side effect, `json.method_missing "hello"` now reaches `#set!` with
both a key and a value `set!(:method_missing, "hello")`, like any other
DSL call, and produces `{"method_missing": "hello"}`. Before this patch
the public alias was called directly as `set!("hello")`, a single-arg
call that was silently dropped because `_set_value` short-circuits on a
`BLANK` value, so the key never appeared in the output at all.

Discovered by accident while migrating a Rails app to Jbuilder, where an
object happened to expose `method_missing` as a key and produced
unexpected output.
@rafaelfranca rafaelfranca merged commit 363c3c8 into rails:main May 15, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants