Attachment 672191 Details for Bug 889649 – CVE-2012-5664-3-1-dynamic_finder_injection.patch

[patch] CVE-2012-5664-3-1-dynamic_finder_injection.patch

CVE-2012-5664-3-1-dynamic_finder_injection.patch (text/plain), 2.10 KB, created by Kurt Seifried on 2013-01-03 20:24:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-01-03 20:24:52 UTC

Size: 2.10 KB

patch

obsolete

>From c42f548960fe2359571e62748bf7b92f4fa22f66 Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Sun, 23 Dec 2012 11:07:07 -0800
>Subject: [PATCH] CVE-2012-5664 options hashes should only be extracted if
> there are extra parameters
>
>---
> activerecord/lib/active_record/base.rb |    6 +++++-
> activerecord/test/cases/finder_test.rb |   12 ++++++++++++
> 2 files changed, 17 insertions(+), 1 deletion(-)
>
>diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb
>index aafb48d..ffa4a48 100644
>--- a/activerecord/lib/active_record/base.rb
>+++ b/activerecord/lib/active_record/base.rb
>@@ -1065,7 +1065,11 @@ Calling dynamic finder with less number of arguments than the number of attribut
>                 eowarn
>             end
>             if match.finder?
>-              options = arguments.extract_options!
>+              options = if arguments.length > attribute_names.size
>+                          arguments.extract_options!
>+                        else
>+                          {}
>+                        end
>               relation = options.any? ? scoped(options) : scoped
>               relation.send :find_by_attributes, match, attribute_names, *arguments
>             elsif match.instantiator?
>diff --git a/activerecord/test/cases/finder_test.rb b/activerecord/test/cases/finder_test.rb
>index bab9857..546f7ee 100644
>--- a/activerecord/test/cases/finder_test.rb
>+++ b/activerecord/test/cases/finder_test.rb
>@@ -15,6 +15,18 @@ require 'models/toy'
> class FinderTest < ActiveRecord::TestCase
>   fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers, :categories, :categorizations
> 
>+  def test_find_by_id_with_hash
>+    assert_raises(ActiveRecord::StatementInvalid) do
>+      Post.find_by_id(:limit => 1)
>+    end
>+  end
>+
>+  def test_find_by_title_and_id_with_hash
>+    assert_raises(ActiveRecord::StatementInvalid) do
>+      Post.find_by_title_and_id('foo', :limit => 1)
>+    end
>+  end
>+
>   def test_find
>     assert_equal(topics(:first).title, Topic.find(1).title)
>   end
>-- 
>1.7.10.2 (Apple Git-33)
>

Actions: View | Diff

Attachments on bug 889649: 672189 | 672190 | 672191 | 672192