Permalink
Browse files

active_record: Quote numeric values compared to string columns.

  • Loading branch information...
dylanahsmith committed Feb 6, 2013
1 parent 10513d2 commit 0fc58caf184c77cd741e92655f33e34f554b025b
View
@@ -1,4 +1,14 @@
-## Rails 3.0.20 (unreleased)
+## Rails 3.0.21 (unreleased)
+
+* Quote numeric values being compared to non-numeric columns. Otherwise,
+ in some database, the string column values will be coerced to a numeric
+ allowing 0, 0.0 or false to match any string starting with a non-digit.
+
+ Example:
+
+ App.where(apikey: 0) # => SELECT * FROM users WHERE apikey = '0'
+
+## Rails 3.0.20 (Jan 28, 2013)
## Rails 3.0.19 (Jan 8, 2013)
@@ -21,11 +21,21 @@ def quote(value, column = nil)
"'#{quote_string(value)}'" # ' (for ruby-mode)
end
when NilClass then "NULL"
- when TrueClass then (column && column.type == :integer ? '1' : quoted_true)
- when FalseClass then (column && column.type == :integer ? '0' : quoted_false)
- when Float, Fixnum, Bignum then value.to_s
- # BigDecimals need to be output in a non-normalized form and quoted.
- when BigDecimal then value.to_s('F')
+ when TrueClass, FalseClass
+ if column && column.type == :integer
+ value ? '1' : '0'
+ elsif column && [:text, :string, :binary].include?(column.type)
+ value ? "'1'" : "'0'"
+ else
+ value ? quoted_true : quoted_false
+ end
+ when Numeric, ActiveSupport::Duration
+ # BigDecimals need to be output in a non-normalized form and quoted.
+ value = BigDecimal === value ? value.to_s('F') : value.to_s
+ if column && ![:integer, :float, :decimal].include?(column.type)
+ value = "'#{value}'"
+ end
+ value
when Symbol then "'#{quote_string(value.to_s)}'"
else
if value.acts_like?(:date) || value.acts_like?(:time)
@@ -191,8 +191,6 @@ def quote(value, column = nil)
if value.kind_of?(String) && column && column.type == :binary && column.class.respond_to?(:string_to_binary)
s = column.class.string_to_binary(value).unpack("H*")[0]
"x'#{s}'"
- elsif value.kind_of?(BigDecimal)
- value.to_s("F")
else
super
end
@@ -40,6 +40,9 @@ def build_from_hash(attributes, default_table, allow_table_name = true)
when Class
# FIXME: I think we need to deprecate this behavior
attribute.eq(value.name)
+ when Integer, ActiveSupport::Duration
+ # Arel treats integers as literals, but they should be quoted when compared with strings
+ attribute.eq(Arel::Nodes::SqlLiteral.new(@engine.connection.quote(value, attribute.column)))
else
attribute.eq(value)
end
@@ -35,5 +35,33 @@ def test_where_with_table_name_and_empty_array
def test_where_with_empty_hash_and_no_foreign_key
assert_equal 0, Edge.where(:sink => {}).count
end
+
+ def test_where_with_integer_for_string_column
+ count = Post.where(:title => 0).count
+ assert_equal 0, count
+ end
+
+ def test_where_with_float_for_string_column
+ count = Post.where(:title => 0.0).count
+ assert_equal 0, count
+ end
+
+ def test_where_with_boolean_for_string_column
+ count = Post.where(:title => false).count
+ assert_equal 0, count
+ end
+
+ def test_where_with_decimal_for_string_column
+ count = Post.where(:title => BigDecimal.new(0)).count
+ if count > 0 && current_adapter?(:Mysql2Adapter)
+ return skip("upstream bug in mysql2")
+ end
+ assert_equal 0, count
+ end
+
+ def test_where_with_duration_for_string_column
+ count = Post.where(:title => 0.seconds).count
+ assert_equal 0, count
+ end
end
end
@@ -444,6 +444,8 @@ def create_table(*args, &block)
create_table :price_estimates, :force => true do |t|
t.string :estimate_of_type
t.integer :estimate_of_id
+ t.string :thing_type
+ t.integer :thing_id
t.integer :price
end

0 comments on commit 0fc58ca

Please sign in to comment.