Add BlocksJsonSerialization model concern and include it in User

2 files changed, 18 insertions, 0 deletions

diff --git a/spec/models/concerns/blocks_json_serialization_spec.rb b/spec/models/concerns/blocks_json_serialization_spec.rb
new file mode 100644
index 00000000000..84f8ccc238e
--- /dev/null
+++ b/spec/models/concerns/blocks_json_serialization_spec.rb
@@ -0,0 +1,17 @@
+require 'rails_helper'
+
+describe BlocksJsonSerialization do
+  DummyModel = Class.new do
+    include BlocksJsonSerialization
+  end
+
+  it 'blocks as_json' do
+    expect { DummyModel.new.to_json }
+      .to raise_error(SecurityError, "JSON serialization has been disabled on DummyModel")
+  end
+
+  it 'blocks to_json' do
+    expect { DummyModel.new.to_json }
+      .to raise_error(SecurityError, "JSON serialization has been disabled on DummyModel")
+  end
+end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 4687d9dfa00..e58e7588df0 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -12,6 +12,7 @@ describe User do
     it { is_expected.to include_module(Referable) }
     it { is_expected.to include_module(Sortable) }
     it { is_expected.to include_module(TokenAuthenticatable) }
+    it { is_expected.to include_module(BlocksJsonSerialization) }
   end
 
   describe 'delegations' do