AshReports.Security.AtomValidator (ash_reports v0.1.0)

Validates and safely converts strings to atoms using whitelists.

This module prevents atom table exhaustion attacks by only allowing conversion of whitelisted string values to atoms. All other values are kept as strings or rejected with clear error messages.

Security Rationale

Elixir atoms are not garbage collected. Creating atoms dynamically from user input can lead to atom table exhaustion (default limit: ~1M atoms), causing the VM to crash (DoS vulnerability).

Usage

# Safe - uses whitelist
AtomValidator.to_chart_type("bar")
#=> {:ok, :bar}

# Safe - rejects unknown
AtomValidator.to_chart_type("malicious")
#=> {:error, :invalid_chart_type}

# Safe - keeps as string
AtomValidator.to_field_name("user_input")
#=> {:ok, "user_input"}

Summary

Functions

allowed_aggregation_functions()

Returns the list of allowed aggregation functions.

allowed_chart_providers()

Returns the list of allowed chart providers.

allowed_chart_types()

Returns the list of allowed chart types.

allowed_export_formats()

Returns the list of allowed export formats.

allowed_sort_directions()

Returns the list of allowed sort directions.

to_aggregation_function(value)

Converts an aggregation function string to an atom if allowed.

to_chart_provider(value)

Converts a string to a chart provider atom if it's in the allowed list.

to_chart_type(value)

Converts a string to a chart type atom if it's in the allowed list.

to_export_format(value)

Converts a string to an export format atom if it's in the allowed list.

to_field_name(value)

Safely handles field names by keeping them as strings.

to_sort_direction(value)

Converts a string to a sort direction atom if it's in the allowed list.

Functions

allowed_aggregation_functions()

Returns the list of allowed aggregation functions.

allowed_chart_providers()

Returns the list of allowed chart providers.

allowed_chart_types()

Returns the list of allowed chart types.

allowed_export_formats()

Returns the list of allowed export formats.

allowed_sort_directions()

Returns the list of allowed sort directions.

to_aggregation_function(value)

@spec to_aggregation_function(String.t() | atom()) ::
  {:ok, atom()} | {:error, :invalid_aggregation_function}

Converts an aggregation function string to an atom if allowed.

to_chart_provider(value)

@spec to_chart_provider(String.t() | atom()) ::
  {:ok, atom()} | {:error, :invalid_chart_provider}

Converts a string to a chart provider atom if it's in the allowed list.

to_chart_type(value)

@spec to_chart_type(String.t() | atom()) ::
  {:ok, atom()} | {:error, :invalid_chart_type}

Converts a string to a chart type atom if it's in the allowed list.

Examples

iex> AtomValidator.to_chart_type("bar")
{:ok, :bar}

iex> AtomValidator.to_chart_type("invalid")
{:error, :invalid_chart_type}

iex> AtomValidator.to_chart_type(:bar)
{:ok, :bar}

to_export_format(value)

@spec to_export_format(String.t() | atom()) ::
  {:ok, atom()} | {:error, :invalid_export_format}

Converts a string to an export format atom if it's in the allowed list.

to_field_name(value)

@spec to_field_name(String.t() | atom()) :: {:ok, String.t() | atom()}

Safely handles field names by keeping them as strings.

Field names come from user data/schema and should never be converted to atoms to prevent atom table exhaustion.

Examples

iex> AtomValidator.to_field_name("user_field")
{:ok, "user_field"}

iex> AtomValidator.to_field_name(:existing_atom)
{:ok, :existing_atom}

to_sort_direction(value)

@spec to_sort_direction(String.t() | atom()) ::
  {:ok, atom()} | {:error, :invalid_sort_direction}

Converts a string to a sort direction atom if it's in the allowed list.