Merge pull request #101 from rspec/use-public-send

Use public_send

Author: JonRowe

Diff for: Changelog.md

@@ -1,9 +1,11 @@
 ### 2.0.0.pre
 
-Version 2.0.0 is a maintenance release, it drops support for Ruby below 3, and 
-changes the supported RSpec version to "main" and current release series.
-(At the time of writing this is 3.13.x, but it means the current supported
-release only).
+Version 2.0.0 drops support for Ruby below 3, and changes the supported RSpec version to "main" and current release series.
+(At the time of writing this is 3.13.x, but it means the current supported release only).
+
+Breaking changes:
+
+* Now uses `public_send` so that private methods will not be accidentally reachable. (James Ottaway #33, #101)
 
 ### 1.3.1 / 2024-10-23
 [full changelog](http://github.com/rspec/rspec-its/compare/v1.3.0...v1.3.1)

Diff for: lib/rspec/its/subject.rb

@@ -15,7 +15,7 @@ def for(attribute, subject)
         else
           attribute_chain = attribute.to_s.split('.')
           attribute_chain.inject(subject) do |inner_subject, attr|
-            inner_subject.send(attr)
+            inner_subject.public_send(attr)
           end
         end
       end

Diff for: spec/rspec/its_spec.rb

@@ -393,4 +393,32 @@ def self.example(*_args)
 
     its(:will_still_work) { is_expected.to be true }
   end
+
+  context "with private method" do
+    subject(:klass) do
+      Class.new do
+        def name
+          private_name
+        end
+
+        private
+
+        def private_name
+          "John"
+        end
+      end.new
+    end
+
+    context "when referring indirectly" do
+      its(:name) { is_expected.to eq "John" }
+    end
+
+    context "when attempting to refer directly" do
+      context "it raises an error" do
+        its(:private_name) do
+          expect { is_expected.to eq("John") }.to raise_error(NoMethodError)
+        end
+      end
+    end
+  end
 end