Skip to content
This repository
tree: ceb33f8493
Fetching contributors…

Cannot retrieve contributors at this time

file 194 lines (170 sloc) 7.235 kb
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194
require 'active_support/concern'

module ActiveRecord
  module Sanitization
    extend ActiveSupport::Concern

    module ClassMethods
      def quote_value(value, column = nil) #:nodoc:
        connection.quote(value,column)
      end

      # Used to sanitize objects before they're used in an SQL SELECT statement. Delegates to <tt>connection.quote</tt>.
      def sanitize(object) #:nodoc:
        connection.quote(object)
      end

      protected

      # Accepts an array, hash, or string of SQL conditions and sanitizes
      # them into a valid SQL fragment for a WHERE clause.
      # ["name='%s' and group_id='%s'", "foo'bar", 4] returns "name='foo''bar' and group_id='4'"
      # { :name => "foo'bar", :group_id => 4 } returns "name='foo''bar' and group_id='4'"
      # "name='foo''bar' and group_id='4'" returns "name='foo''bar' and group_id='4'"
      def sanitize_sql_for_conditions(condition, table_name = self.table_name)
        return nil if condition.blank?

        case condition
        when Array; sanitize_sql_array(condition)
        when Hash; sanitize_sql_hash_for_conditions(condition, table_name)
        else condition
        end
      end
      alias_method :sanitize_sql, :sanitize_sql_for_conditions

      # Accepts an array, hash, or string of SQL conditions and sanitizes
      # them into a valid SQL fragment for a SET clause.
      # { :name => nil, :group_id => 4 } returns "name = NULL , group_id='4'"
      def sanitize_sql_for_assignment(assignments)
        case assignments
          when Array; sanitize_sql_array(assignments)
          when Hash; sanitize_sql_hash_for_assignment(assignments)
          else assignments
        end
      end

      # Accepts a hash of SQL conditions and replaces those attributes
      # that correspond to a +composed_of+ relationship with their expanded
      # aggregate attribute values.
      # Given:
      # class Person < ActiveRecord::Base
      # composed_of :address, :class_name => "Address",
      # :mapping => [%w(address_street street), %w(address_city city)]
      # end
      # Then:
      # { :address => Address.new("813 abc st.", "chicago") }
      # # => { :address_street => "813 abc st.", :address_city => "chicago" }
      def expand_hash_conditions_for_aggregates(attrs)
        expanded_attrs = {}
        attrs.each do |attr, value|
          unless (aggregation = reflect_on_aggregation(attr.to_sym)).nil?
            mapping = aggregate_mapping(aggregation)
            mapping.each do |field_attr, aggregate_attr|
              if mapping.size == 1 && !value.respond_to?(aggregate_attr)
                expanded_attrs[field_attr] = value
              else
                expanded_attrs[field_attr] = value.send(aggregate_attr)
              end
            end
          else
            expanded_attrs[attr] = value
          end
        end
        expanded_attrs
      end

      # Sanitizes a hash of attribute/value pairs into SQL conditions for a WHERE clause.
      # { :name => "foo'bar", :group_id => 4 }
      # # => "name='foo''bar' and group_id= 4"
      # { :status => nil, :group_id => [1,2,3] }
      # # => "status IS NULL and group_id IN (1,2,3)"
      # { :age => 13..18 }
      # # => "age BETWEEN 13 AND 18"
      # { 'other_records.id' => 7 }
      # # => "`other_records`.`id` = 7"
      # { :other_records => { :id => 7 } }
      # # => "`other_records`.`id` = 7"
      # And for value objects on a composed_of relationship:
      # { :address => Address.new("123 abc st.", "chicago") }
      # # => "address_street='123 abc st.' and address_city='chicago'"
      def sanitize_sql_hash_for_conditions(attrs, default_table_name = self.table_name)
        attrs = expand_hash_conditions_for_aggregates(attrs)

        table = Arel::Table.new(table_name).alias(default_table_name)
        PredicateBuilder.build_from_hash(arel_engine, attrs, table).map { |b|
          connection.visitor.accept b
        }.join(' AND ')
      end
      alias_method :sanitize_sql_hash, :sanitize_sql_hash_for_conditions

      # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
      # { :status => nil, :group_id => 1 }
      # # => "status = NULL , group_id = 1"
      def sanitize_sql_hash_for_assignment(attrs)
        attrs.map do |attr, value|
          "#{connection.quote_column_name(attr)} = #{quote_bound_value(value)}"
        end.join(', ')
      end

      # Accepts an array of conditions. The array has each value
      # sanitized and interpolated into the SQL statement.
      # ["name='%s' and group_id='%s'", "foo'bar", 4] returns "name='foo''bar' and group_id='4'"
      def sanitize_sql_array(ary)
        statement, *values = ary
        if values.first.is_a?(Hash) && statement =~ /:\w+/
          replace_named_bind_variables(statement, values.first)
        elsif statement.include?('?')
          replace_bind_variables(statement, values)
        elsif statement.blank?
          statement
        else
          statement % values.collect { |value| connection.quote_string(value.to_s) }
        end
      end

      alias_method :sanitize_conditions, :sanitize_sql

      def replace_bind_variables(statement, values) #:nodoc:
        raise_if_bind_arity_mismatch(statement, statement.count('?'), values.size)
        bound = values.dup
        c = connection
        statement.gsub('?') { quote_bound_value(bound.shift, c) }
      end

      def replace_named_bind_variables(statement, bind_vars) #:nodoc:
        statement.gsub(/(:?):([a-zA-Z]\w*)/) do
          if $1 == ':' # skip postgresql casts
            $& # return the whole match
          elsif bind_vars.include?(match = $2.to_sym)
            quote_bound_value(bind_vars[match])
          else
            raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}"
          end
        end
      end

      def expand_range_bind_variables(bind_vars) #:nodoc:
        expanded = []

        bind_vars.each do |var|
          next if var.is_a?(Hash)

          if var.is_a?(Range)
            expanded << var.first
            expanded << var.last
          else
            expanded << var
          end
        end

        expanded
      end

      def quote_bound_value(value, c = connection) #:nodoc:
        if value.respond_to?(:map) && !value.acts_like?(:string)
          if value.respond_to?(:empty?) && value.empty?
            c.quote(nil)
          else
            value.map { |v| c.quote(v) }.join(',')
          end
        else
          c.quote(value)
        end
      end

      def raise_if_bind_arity_mismatch(statement, expected, provided) #:nodoc:
        unless expected == provided
          raise PreparedStatementInvalid, "wrong number of bind variables (#{provided} for #{expected}) in: #{statement}"
        end
      end
    end

    # TODO: Deprecate this
    def quoted_id #:nodoc:
      quote_value(id, column_for_attribute(self.class.primary_key))
    end

    private

    # Quote strings appropriately for SQL statements.
    def quote_value(value, column = nil)
      self.class.connection.quote(value, column)
    end
  end
end
Something went wrong with that request. Please try again.