Permalink
Browse files

CVE-2012-5664 options hashes should only be extracted if there are ex…

…tra parameters
  • Loading branch information...
1 parent 826548b commit 3542641ebd83a31f6b633b7af30ae6f37e563a1b @tenderlove tenderlove committed Dec 23, 2012
Showing with 17 additions and 1 deletion.
  1. +5 −1 activerecord/lib/active_record/base.rb
  2. +12 −0 activerecord/test/cases/finder_test.rb
@@ -988,7 +988,11 @@ def method_missing(method_id, *arguments, &block)
attribute_names = match.attribute_names
super unless all_attributes_exists?(attribute_names)
if match.finder?
- options = arguments.extract_options!
+ options = if arguments.length > attribute_names.size
+ arguments.extract_options!
+ else
+ {}
+ end
relation = options.any? ? construct_finder_arel(options, current_scoped_methods) : scoped
relation.send :find_by_attributes, match, attribute_names, *arguments
elsif match.instantiator?
@@ -65,6 +65,18 @@ def test_find_or_create_by
class FinderTest < ActiveRecord::TestCase
fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers, :categories, :categorizations
+ def test_find_by_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_id(:limit => 1)
+ end
+ end
+
+ def test_find_by_title_and_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_title_and_id('foo', :limit => 1)
+ end
+ end
+
def test_find
assert_equal(topics(:first).title, Topic.find(1).title)
end

0 comments on commit 3542641

Please sign in to comment.