Permalink
Browse files

CVE-2012-5664 options hashes should only be extracted if there are ex…

…tra parameters
  • Loading branch information...
1 parent e8c0597 commit 9de9b359d0d24f70f0f6c5c58a7ad8750684d456 @tenderlove tenderlove committed Dec 23, 2012
Showing with 17 additions and 1 deletion.
  1. +5 −1 activerecord/lib/active_record/base.rb
  2. +12 −0 activerecord/test/cases/finder_test.rb
View
6 activerecord/lib/active_record/base.rb
@@ -1897,7 +1897,11 @@ def method_missing(method_id, *arguments, &block)
# end
self.class_eval <<-EOS, __FILE__, __LINE__ + 1
def self.#{method_id}(*args)
- options = args.extract_options!
+ options = if args.length > #{attribute_names.size}
+ args.extract_options!
+ else
+ {}
+ end
attributes = construct_attributes_from_arguments(
[:#{attribute_names.join(',:')}],
args
View
12 activerecord/test/cases/finder_test.rb
@@ -66,6 +66,18 @@ def test_find_or_create_by
class FinderTest < ActiveRecord::TestCase
fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers
+ def test_find_by_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_id(:limit => 1)
+ end
+ end
+
+ def test_find_by_title_and_id_with_hash
+ assert_raises(ActiveRecord::StatementInvalid) do
+ Post.find_by_title_and_id('foo', :limit => 1)
+ end
+ end
+
def test_find
assert_equal(topics(:first).title, Topic.find(1).title)
end

0 comments on commit 9de9b35

Please sign in to comment.