Attachment 672192 Details for Bug 889649 – CVE-2012-5664-3-2-dynamic_finder_injection.patch

[patch] CVE-2012-5664-3-2-dynamic_finder_injection.patch

CVE-2012-5664-3-2-dynamic_finder_injection.patch (text/plain), 2.10 KB, created by Kurt Seifried on 2013-01-03 20:25:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-01-03 20:25:08 UTC

Size: 2.10 KB

patch

obsolete

>From 325669f0795a9148fd31f7f496a40dc8e114ef52 Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Sun, 23 Dec 2012 11:07:07 -0800
>Subject: [PATCH] CVE-2012-5664 options hashes should only be extracted if
> there are extra parameters
>
>---
> activerecord/lib/active_record/dynamic_matchers.rb |    7 ++++++-
> activerecord/test/cases/finder_test.rb             |   12 ++++++++++++
> 2 files changed, 18 insertions(+), 1 deletion(-)
>
>diff --git a/activerecord/lib/active_record/dynamic_matchers.rb b/activerecord/lib/active_record/dynamic_matchers.rb
>index b6b8e24..f15d0b7 100644
>--- a/activerecord/lib/active_record/dynamic_matchers.rb
>+++ b/activerecord/lib/active_record/dynamic_matchers.rb
>@@ -40,7 +40,12 @@ module ActiveRecord
>           METHOD
>           send(method_id, *arguments)
>         elsif match.finder?
>-          options = arguments.extract_options!
>+          options = if arguments.length > attribute_names.size
>+                      arguments.extract_options!
>+                    else
>+                      {}
>+                    end
>+
>           relation = options.any? ? scoped(options) : scoped
>           relation.send :find_by_attributes, match, attribute_names, *arguments, &block
>         elsif match.instantiator?
>diff --git a/activerecord/test/cases/finder_test.rb b/activerecord/test/cases/finder_test.rb
>index 5d72e35..77ca3b5 100644
>--- a/activerecord/test/cases/finder_test.rb
>+++ b/activerecord/test/cases/finder_test.rb
>@@ -15,6 +15,18 @@ require 'models/toy'
> class FinderTest < ActiveRecord::TestCase
>   fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers, :categories, :categorizations
> 
>+  def test_find_by_id_with_hash
>+    assert_raises(ActiveRecord::StatementInvalid) do
>+      Post.find_by_id(:limit => 1)
>+    end
>+  end
>+
>+  def test_find_by_title_and_id_with_hash
>+    assert_raises(ActiveRecord::StatementInvalid) do
>+      Post.find_by_title_and_id('foo', :limit => 1)
>+    end
>+  end
>+
>   def test_find
>     assert_equal(topics(:first).title, Topic.find(1).title)
>   end
>-- 
>1.7.10.2 (Apple Git-33)
>

Actions: View | Diff

Attachments on bug 889649: 672189 | 672190 | 672191 | 672192