Security vulnerability fixed - it is possible to cause the WHERE clause of a query to be omitted

lib/dm-do-adapter/adapter.rb

@@ -690,7 +690,7 @@ def comparison_statement(comparison, qualify)
             else
               return conditions_statement(comparison.foreign_key_mapping, qualify)
             end
-          elsif comparison.slug == :in && !value.any?
+          elsif comparison.slug == :in && empty_comparison?(value)
             return []  # match everything
           end
 
@@ -752,6 +752,11 @@ def quote_name(name)
 
       end
 
+      # @api private
+      def empty_comparison?(value)
+        value.respond_to?(:empty?) && value.empty?
+      end
+
       include SQL
 
     end

lib/dm-do-adapter/spec/shared_spec.rb

@@ -396,6 +396,23 @@ class ::Author
         end
       end
 
+      describe 'with an inclusion comparison of falsy values' do
+        before :all do
+          5.times do |index|
+            @article_model.create(:name => "Test #{index}", :parent => @article_model.last).should be_saved
+          end
+
+          @parents = [nil]
+          @query   = DataMapper::Query.new(repository, @article_model, :parent => @parents)
+          @return  = @adapter.read(@query)
+        end
+
+        it 'should return records with matching values' do
+          @return.size.should == 1
+          @return.to_a.first.should == @article_model.first.attributes(:property)
+        end
+      end
+
     end
 
     describe 'with a Query Path' do