activerecord-sort 8.0.0 → 8.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50d689663cb6717dab8e034f88d8645cf24a31489e322ca79d9cd52634281dc4
-  data.tar.gz: 544297bd2fc5b8322f8a719d3a4f52e235681a1c756dc191ac74fd69a4c556a7
+  metadata.gz: '00973c2942f313280f8239187ec8c9e0a6ae444211606154c92b10c54333b109'
+  data.tar.gz: d00b63b7250b0b7789c9d02aa6d4654db904ffca88a99e19650715ccd9c25884
 SHA512:
-  metadata.gz: b0caa63a30b528ed30f2fa2ff5c29fe779fd633e9d30ec4404ede2c8b08f9a24a1832b3bd4bd10c39914bebe07cfd8fe23b10ce93496b254d6bb81d2450a3c9e
-  data.tar.gz: afc2f2911285ed3e681a39013013ad1b9ffbce9161a4ac5bb2da6fda40ddd03421942f3b42eaf0c0a3865878fe667759d4c77df0b8962b431937267be40a9d70
+  metadata.gz: e50419cf6d24fb591606d97f39d7928b16daffd65ee8d2f70e3f105508e3c5073d2bdd3d1187cc150f0ef3014e422277ba91afad44d6287e19cc3b8fd12fe784
+  data.tar.gz: dfc4e53f7e3f115c84c2804220e91475dd85c930759ac67af1cdf9b0c0f40d0be9327e0e789f5c15481d74837b7c9c83231311ff1c0723d4e729a0f4f813eb5a

data/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## [8.0.1] - 2026-09-04
+
+### Changed
+
+- Enabled `# frozen_string_literal: true`, so the gem no longer allocates a
+  new String for each literal it evaluates.
+- An unrecognized value in the nulls position now raises
+  `ActiveRecord::Sort::InvalidSort` instead of being silently dropped.
+  `sort(:name => {:asc => :nulls_frist})` previously ordered by a plain
+  `ASC`, quietly returning results in the wrong null order; it now raises,
+  like any other unknown sort value. A blank nulls value still means "no
+  `NULLS` clause" rather than an invalid one — `""` (what query params
+  send) and `nil` (what JSON sends) are both absent, not wrong.
+
+### Fixed
+
+- Directions and nulls values are now matched case-insensitively wherever
+  they appear. `sort(:name => 'DESC')` already downcased, but the hash forms
+  did not, so `sort(:name => {'DESC' => 'NULLS_LAST'})` raised on the same
+  input the bare form accepted.
+- `sort(:name => {})` now sorts ascending instead of raising. An empty hash
+  states no direction, which is what `""` (from a query string) and `nil`
+  (from JSON) already meant; the blank check simply sat after the hash
+  check and so never saw it.
+- Sort parameters holding `nil` or a non-string key no longer raise
+  `NoMethodError`. `{"name" => {"asc" => nil}}`, `{"name" => {nil =>
+  "asc"}}` and a non-string column such as `{123 =>
+  "asc"}` — all reachable from a JSON request body, where a query string
+  would send `""` — now raise `ActiveRecord::Sort::InvalidSort`, or sort
+  normally where the value is merely absent, honoring the documented
+  contract that unfiltered params are rescuable as
+  `ActiveRecord::StatementInvalid`.
+
 ## [8.0.0] - 2026-08-27
 
 ### Breaking changes

data/README.md

@@ -2,8 +2,12 @@
 
 `ActiveRecord::Sort` provides an easy, safe way to accept user input and order a
 query by it. Only recognized columns and associations produce SQL — anything
-else raises `ActiveRecord::StatementInvalid`, so it's safe to pass request
-parameters straight through.
+else raises `ActiveRecord::StatementInvalid`, so unfiltered request parameters
+can't inject SQL.
+
+Recognized is not the same as permitted, though. Every column on the model and
+on its associations is sortable, including ones you never expose — see
+[Restricting what can be sorted](#restricting-what-can-be-sorted).
 
 Requirements
 ------------
@@ -110,3 +114,35 @@ it loads the records and sorts them by `<=>` — rather than building a query:
 Property.all.sort            # => Array of Property, sorted by <=>
 Property.sort(nil)           # => relation (unchanged), for chaining
 ```
+
+Restricting what can be sorted
+------------------------------
+
+`#sort` checks that a name is a real column or association — not that the
+requester is allowed to know about it. Every column is sortable, including the
+ones you don't select:
+
+```ruby
+User.sort(:password_digest)               # valid, and it sorts
+Post.sort(author: :reset_password_token)  # so is this
+```
+
+A sort reveals something about a column even though its values are never
+returned, because the resulting order is a comparison. Someone with a row they
+control can set their own value, see which side of it a target row lands on,
+and narrow the value down over a series of ordinary-looking requests. Equal
+values also sort together, which is enough to tell that two accounts share a
+password hash.
+
+So passing parameters straight through is safe as far as SQL injection goes,
+but *which* columns may be sorted is an authorization question, and only your
+application can answer it. Filter the parameters before they reach `#sort`:
+
+```ruby
+SORTABLE = %w[name created_at].freeze
+
+Property.sort(sort_params.slice(*SORTABLE))
+```
+
+[StandardAPI](https://github.com/malomalo/standardapi) does this with an ACL,
+resolving per request which attributes a user may read and sort by.

data/ext/active_record/base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_record'
 require 'active_record/relation'
 
@@ -41,14 +43,16 @@ module ActiveRecord
       ordering.each do |order|
         order = Array(order)
         order.each do |column_or_relation, options|
-          if column_or_relation.to_sym == :random
+          key = column_or_relation.to_s
+
+          if key == 'random'
             resource = resource.order(Arel::Nodes::RandomOrdering.new)
-          elsif self.column_names.include?(column_or_relation.to_s)
-            resource = resource.sort_for_column(self.arel_table[column_or_relation.to_s], options)
-          elsif reflect_on_association(column_or_relation.to_sym)
-            resource = resource.sort_for_relation(column_or_relation.to_sym, options)
+          elsif self.column_names.include?(key)
+            resource = resource.sort_for_column(self.arel_table[key], options)
+          elsif reflect_on_association(key)
+            resource = resource.sort_for_relation(key, options)
           else
-            raise InvalidSort.new("Unknown column #{column_or_relation}")
+            raise InvalidSort.new("Unknown column #{key}")
           end
         end
       end
@@ -58,24 +62,43 @@ module ActiveRecord
 
     # Normalizes per-column sort options into [direction, nulls]. A blank
     # direction — a bare column, or "" as query params often produce —
-    # means :asc.
-    # TODO: probably don't need to cast to sym
+    # means 'asc'; a blank or nil value means no NULLS clause.
     def sort_direction_and_nulls(options)
-      if options.is_a?(Hash) || options.class.name == "ActionController::Parameters"
-        [options.keys.first.to_sym, options.values.first.to_sym]
-      elsif options.blank?
-        [:asc, nil]
+      if options.blank?
+        ['asc', nil]
+      elsif options.is_a?(Hash) || options.class.name == "ActionController::Parameters"
+        direction = options.keys.first.to_s.downcase
+
+        if direction == 'asc' || direction == 'desc'
+          [direction, sort_nulls(options.values.first)]
+        else
+          [direction, nil]
+        end
       else
-        [options.to_s.downcase.to_sym, nil]
+        [options.to_s.downcase, nil]
       end
     end
 
+    # Cast on the way out: Arel's visitor matches the nulls value with
+    # `case o.nulls when :nulls_first`, so this is the one value that has
+    # to reach the node as a symbol.
+    def sort_nulls(value)
+      return nil if value.blank?
+
+      nulls = value.to_s.downcase
+      if nulls != 'nulls_first' && nulls != 'nulls_last'
+        raise InvalidSort.new("Unknown nulls ordering #{value}")
+      end
+
+      nulls.to_sym
+    end
+
     def sort_for_column(column, options)
       direction, nulls = sort_direction_and_nulls(options)
 
-      if direction == :desc
+      if direction == 'desc'
         self.order(Arel::Nodes::Descending.new(column, nulls))
-      elsif direction == :asc
+      elsif direction == 'asc'
         self.order(Arel::Nodes::Ascending.new(column, nulls))
       else
         raise InvalidSort.new("Unknown ordering #{direction}")
@@ -126,9 +149,9 @@ module ActiveRecord
 
           direction, nulls = sort_direction_and_nulls(column_options)
 
-          order = if direction == :desc
+          order = if direction == 'desc'
             Arel::Nodes::Descending.new(column.maximum, nulls)
-          elsif direction == :asc
+          elsif direction == 'asc'
             Arel::Nodes::Ascending.new(column.minimum, nulls)
           else
             raise InvalidSort.new("Unknown ordering #{direction}")

data/lib/active_record/sort/version.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   module Sort
-    VERSION = '8.0.0'
+    VERSION = '8.0.1'
   end
 end

data/lib/active_record/sort.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_record'
 require 'arel/extensions'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-sort
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.0.1
 platform: ruby
 authors:
 - Jon Bracy