Attachment 863434 Details for Bug 1065517 – 4-0-array_injection.patch

[patch] 4-0-array_injection.patch

4-0-array_injection.patch (text/plain), 2.15 KB, created by Kurt Seifried on 2014-02-14 21:39:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2014-02-14 21:39:57 UTC

Size: 2.15 KB

patch

obsolete

>From 5a821452bf76bbb7be8f261e07493db84a47761a Mon Sep 17 00:00:00 2001
>From: Aaron Patterson <aaron.patterson@gmail.com>
>Date: Wed, 12 Feb 2014 16:22:40 -0800
>Subject: [PATCH] Correctly escape PostgreSQL arrays.
>
>Thanks Godfrey Chan for reporting this!
>---
> .../lib/active_record/connection_adapters/postgresql/cast.rb      | 6 +++++-
> activerecord/test/cases/adapters/postgresql/datatype_test.rb      | 8 ++++++++
> 2 files changed, 13 insertions(+), 1 deletion(-)
>
>diff --git a/activerecord/lib/active_record/connection_adapters/postgresql/cast.rb b/activerecord/lib/active_record/connection_adapters/postgresql/cast.rb
>index 504ecea..8383a99 100644
>--- a/activerecord/lib/active_record/connection_adapters/postgresql/cast.rb
>+++ b/activerecord/lib/active_record/connection_adapters/postgresql/cast.rb
>@@ -142,12 +142,16 @@ module ActiveRecord
>             end
>           end
> 
>+          ARRAY_ESCAPE = "\\" * 2 * 2 # escape the backslash twice for PG arrays
>+
>           def quote_and_escape(value)
>             case value
>             when "NULL", Numeric
>               value
>             else
>-              "\"#{value.gsub(/"/,"\\\"")}\""
>+              value = value.gsub(/\\/, ARRAY_ESCAPE)
>+              value.gsub!(/"/,"\\\"")
>+              "\"#{value}\""
>             end
>           end
>       end
>diff --git a/activerecord/test/cases/adapters/postgresql/datatype_test.rb b/activerecord/test/cases/adapters/postgresql/datatype_test.rb
>index ca1a613..51cb897 100644
>--- a/activerecord/test/cases/adapters/postgresql/datatype_test.rb
>+++ b/activerecord/test/cases/adapters/postgresql/datatype_test.rb
>@@ -179,6 +179,14 @@ _SQL
>      PostgresqlBitString, PostgresqlOid, PostgresqlTimestampWithZone, PostgresqlUUID].each(&:delete_all)
>   end
> 
>+  def test_array_escaping
>+    unknown = %(foo\\",bar,baz,\\)
>+    nicknames = ["hello_#{unknown}"]
>+    ar = PostgresqlArray.create!(nicknames: nicknames, id: 100)
>+    ar.reload
>+    assert_equal nicknames, ar.nicknames
>+  end
>+
>   def test_data_type_of_array_types
>     assert_equal :integer, @first_array.column_for_attribute(:commission_by_quarter).type
>     assert_equal :text, @first_array.column_for_attribute(:nicknames).type
>-- 
>1.8.4.1
>

Actions: View | Diff

Attachments on bug 1065517: 863434 | 863435