active_force 0.27.0 → 0.27.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c4cc417eaaf0ad9a412c1a39374d80e4a723d0f8d6184eba87c09371e3ba56a
-  data.tar.gz: d8cdb8bc16ab43f8d1fbe4840788e412d5aa0ad3a25734cbc2b85d7138626c75
+  metadata.gz: cc1c415b6de1e133528660a416b470d81eee1b8e075f7150ee9244f32d6c9c4c
+  data.tar.gz: c4a24611cdc27f447c0c3b3e29d14c16c5e8c5b701f9cfcdd6f0469b057e5622
 SHA512:
-  metadata.gz: c005126087818d2afa9ef019e537ae5920fea69f9275ba74293cbe97ea9335cfb62da1deedd1c58e707536357f45cf322dcfa48d38b6d007e89f5210dfaf86b2
-  data.tar.gz: 43623c0cda29edc52f3ccaddad50010a76d88417d6ebcbe5d80c2bd838518eddbaef217a41ec14c0e372ba50dbe8cad4cf3eaebe1f1f0998734bde19a4251d63
+  metadata.gz: 2de4234e2f417c7fc79c04d2dbbc039399f55fa63ea083a5e4b2b45eaf568d18d66fba3d577928d665a4ff816cb45dd15d0169df1837bc4495b6d8d369ebefe5
+  data.tar.gz: 0d35e111badf4d1226d1a422c586fffe0eaa93fd0c50f54b88b381ba1b062b5460cc035e6989baf15583cae916e42c4e2042fce433fb95bfae0db0ebe0ea2c1d

data/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Not released
 
+## 0.27.1
+- `find` and `find!` quote the id the same way `where` quotes string values. The SOQL does not change for ids without `'` or `\`. (https://github.com/Beyond-Finance/active_force/pull/TBD)
+
 ## 0.27.0
 - Emit `query.active_force` notifications for logical query executions, including aggregates and composite batch queries, with SOQL, model, client identity, transport, and standard exception payloads. Cache hits count as logical queries, not API calls. (https://github.com/Beyond-Finance/active_force/pull/117)
 

data/lib/active_force/active_query.rb

@@ -241,10 +241,6 @@ module ActiveForce
       end
     end
 
-    def quote_string(s)
-      "'#{s.gsub(/(['\\])/, '\\\\\\1')}'"
-    end
-
     def result
       soql = self.to_s
 

data/lib/active_force/query.rb

@@ -74,7 +74,7 @@ module ActiveForce
     end
 
     def find id
-      where("#{ @table_id } = '#{ id }'").limit 1
+      where("#{ @table_id } = #{ quote_string(id.to_s) }").limit 1
     end
 
     def first
@@ -112,6 +112,10 @@ module ActiveForce
     end
 
     protected
+      def quote_string(s)
+        "'#{s.gsub(/(['\\])/, '\\\\\\1')}'"
+      end
+
       def and_conditions
         "(#{@conditions.join(') AND (')})" unless @conditions.empty?
       end

data/lib/active_force/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActiveForce
-  VERSION = '0.27.0'
+  VERSION = '0.27.1'
 end

data/spec/active_force/active_query_spec.rb

@@ -465,6 +465,11 @@ describe ActiveForce::ActiveQuery do
       expect(client).to have_received(:query).with("SELECT Id FROM #{sobject.table_name} WHERE (Id = '#{id}') LIMIT 1")
     end
 
+    it 'escapes the id in the query' do
+      active_query.find!("x' OR Id != 'y")
+      expect(client).to have_received(:query).with("SELECT Id FROM #{sobject.table_name} WHERE (Id = 'x\\' OR Id != \\'y') LIMIT 1")
+    end
+
     context 'when record is found' do
       let(:record) { build_restforce_sobject(id: id) }
 

data/spec/active_force/query_spec.rb

@@ -119,6 +119,29 @@ describe ActiveForce::Query do
     it "should return a query for 1 record" do
       expect(query.find(2).to_s).to eq "SELECT Id, name, etc FROM table_name WHERE (Id = '2') LIMIT 1"
     end
+
+    {
+      '15-character id' => ['001A000000abcde', "'001A000000abcde'"],
+      '18-character id' => ['001A000000abcdeAAA', "'001A000000abcdeAAA'"],
+      'nil' => [nil, "''"],
+      'integer' => [1006, "'1006'"],
+      'symbol' => [:abc, "'abc'"],
+      'uuid' => ['eb68d128-9a9b-4cd0-b98a-9abe31194c59', "'eb68d128-9a9b-4cd0-b98a-9abe31194c59'"]
+    }.each do |description, (id, literal)|
+      it "builds the same SOQL as before for a #{description}" do
+        expect(query.find(id).to_s).to eq "SELECT Id, name, etc FROM table_name WHERE (Id = #{literal}) LIMIT 1"
+      end
+    end
+
+    it "escapes single quotes in the id" do
+      expect(query.find("x' OR Name != 'y").to_s)
+        .to eq "SELECT Id, name, etc FROM table_name WHERE (Id = 'x\\' OR Name != \\'y') LIMIT 1"
+    end
+
+    it "escapes backslashes in the id" do
+      expect(query.find("x\\' OR Name != 'y").to_s)
+        .to eq "SELECT Id, name, etc FROM table_name WHERE (Id = 'x\\\\\\' OR Name != \\'y') LIMIT 1"
+    end
   end
 
   describe ".order" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_force
 version: !ruby/object:Gem::Version
-  version: 0.27.0
+  version: 0.27.1
 platform: ruby
 authors:
 - Eloy Espinaco