activerecord 2.3.16 → 2.3.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c6ed2159d7a28549435297c8380fbd449afc8c4d
-  data.tar.gz: 284c1c67270c50ca8dd56dc82e8392fb8ed15941
+  metadata.gz: 218f0ee925039809c1caa780d1acb30a84f62a47
+  data.tar.gz: cc8227ac899f9ff2ec85077f8873a71ce1c67908
 SHA512:
-  metadata.gz: 26a10e8dbd905d3c16a15fe1fe6ad5bf48f6b3585dae1c9c36a63ad9214cc30da81cc369c9560cfa9a35fc13c99355a35cd5948402bada6db4a80c8c24181729
-  data.tar.gz: 5cfb132dd8f8dd4001b930a6afed1424cf15b7125458724d98d1d4c5b412a385192fa2eedb9dc9e0ee385d6b811cc3f0d28efba8825699aef51a3041a0b35b6d
+  metadata.gz: ba910bc95b425f25927ac801fbed29df77b783f7f94967db6c1eddc49a69a14c74b27ab960efbbbcb31cdb639de8b3f3f30978532ab03aefeb10ad0a6f7016bf
+  data.tar.gz: 2a48ad562911d4e4cb37aed8b3a14dcaaae8790f8ea90d759e82a237645ddc687c1f686e620cc0f7d3207c94d2bc5f27228b946e55acee0f9e8070afbfdf845b

data/Rakefile

@@ -192,7 +192,7 @@ spec = Gem::Specification.new do |s|
     s.files = s.files + Dir.glob( "#{dir}/**/*" ).delete_if { |item| item.include?( "\.svn" ) }
   end
 
-  s.add_dependency('activesupport', '= 2.3.16' + PKG_BUILD)
+  s.add_dependency('activesupport', '= 2.3.17' + PKG_BUILD)
 
   s.files.delete FIXTURES_ROOT + "/fixture_database.sqlite"
   s.files.delete FIXTURES_ROOT + "/fixture_database_2.sqlite"

data/lib/active_record/attribute_methods.rb

@@ -80,7 +80,9 @@ module ActiveRecord
           end
 
           unless instance_method_already_implemented?("#{name}=")
-            if create_time_zone_conversion_attribute?(name, column)
+            if self.serialized_attributes[name]
+              define_write_method_for_serialized_attribute(name)
+            elsif create_time_zone_conversion_attribute?(name, column)
               define_write_method_for_time_zone_conversion(name)
             else  
               define_write_method(name.to_sym)
@@ -130,7 +132,7 @@ module ActiveRecord
         # Suffixes a, ?, c become regexp /(a|\?|c)$/
         def rebuild_attribute_method_regexp
           suffixes = attribute_method_suffixes.map { |s| Regexp.escape(s) }
-          @@attribute_method_regexp = /(#{suffixes.join('|')})$/.freeze
+          @@attribute_method_regexp = /(#{suffixes.join('|')})\z/.freeze
         end
 
         # Default to =, ?, _before_type_cast
@@ -184,6 +186,19 @@ module ActiveRecord
         def define_write_method(attr_name)
           evaluate_attribute_method attr_name, "def #{attr_name}=(new_value);write_attribute('#{attr_name}', new_value);end", "#{attr_name}="
         end
+
+        # Defined for all serialized attributes. Disallows assigning already serialized YAML.
+        def define_write_method_for_serialized_attribute(attr_name)
+          method_body = <<-EOV
+            def #{attr_name}=(value)
+              if value.is_a?(String) and value =~ /^---/
+                raise ActiveRecordError, "You tried to assign already serialized content to #{attr_name}. This is disabled due to security issues."
+              end
+              write_attribute(:#{attr_name}, value)
+            end
+          EOV
+          evaluate_attribute_method attr_name, method_body, "#{attr_name}="
+        end
         
         # Defined for all +datetime+ and +timestamp+ attributes when +time_zone_aware_attributes+ are enabled.
         # This enhanced write method will automatically convert the time passed to it to the zone stored in Time.zone.

data/lib/active_record/base.rb

@@ -2998,11 +2998,11 @@ module ActiveRecord #:nodoc:
       def remove_attributes_protected_from_mass_assignment(attributes)
         safe_attributes =
           if self.class.accessible_attributes.nil? && self.class.protected_attributes.nil?
-            attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
+            attributes.reject { |key, value| attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
           elsif self.class.protected_attributes.nil?
-            attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
+            attributes.reject { |key, value| !self.class.accessible_attributes.include?(key.gsub(/\(.+/m, "")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
           elsif self.class.accessible_attributes.nil?
-            attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/, "")) }
+            attributes.reject { |key, value| self.class.protected_attributes.include?(key.gsub(/\(.+/m,"")) || attributes_protected_by_default.include?(key.gsub(/\(.+/m, "")) }
           else
             raise "Declare either attr_protected or attr_accessible for #{self.class}, but not both."
           end

data/lib/active_record/version.rb

@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 16
+    TINY  = 17
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

data/test/cases/base_test.rb

@@ -1499,6 +1499,12 @@ class BasicsTest < ActiveRecord::TestCase
     assert_nil topic.content
   end
 
+  def test_should_raise_exception_on_assigning_already_serialized_content
+    topic = Topic.new
+    serialized_content = %w[foo bar].to_yaml
+    assert_raise(ActiveRecord::ActiveRecordError) { topic.content = serialized_content }
+  end
+
   def test_should_raise_exception_on_serialized_attribute_with_type_mismatch
     myobj = MyObject.new('value1', 'value2')
     topic = Topic.new(:content => myobj)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 2.3.16
+  version: 2.3.17
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-28 00:00:00.000000000 Z
+date: 2013-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.16
+        version: 2.3.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.16
+        version: 2.3.17
 description: Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties
   database tables and classes together for business objects, like Customer or Subscription,
   that can find, save, and destroy themselves without resorting to manual SQL.
@@ -408,7 +408,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: activerecord
-rubygems_version: 2.0.0.preview3.1
+rubygems_version: 2.0.0.rc.2
 signing_key: 
 specification_version: 4
 summary: Implements the ActiveRecord pattern for ORM.