activerecord 4.1.0.beta1 → 4.1.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 47c969d242da2dd41909dde035519bda9ae052d2
-  data.tar.gz: 161da4cf5078bc21183602281a927fcfc037ed1c
+  metadata.gz: 93b5597ffd63ba0a54e42252678f44d1081cdfd9
+  data.tar.gz: 3edb05e2df739c238a64321362241f7b2721ad07
 SHA512:
-  metadata.gz: 33a8969b0e64f955f5c799331daf6d559c22282d0e1bde5032aed25466ca52afb0cb5438704692bbbe520e5f3a4a5ff02475963c8b81905590cc82084489edbe
-  data.tar.gz: 72d64ad26ffde56d6e58c609a97bf1dca7a8cc32278f1e2610138754821805b0b04483111053202b57151881318715ddd8becf34ba75eef7ac108ba3d917cd2e
+  metadata.gz: 69f87e042603602b8bcdf18bee381d7bef2b80b2db18930620f450e57df98a01d7b4c26ef94a0e6923466f589024f2f2a9a8a1ea2eec194caf6fb46804974805
+  data.tar.gz: 65c4c0941f44ab6ff1d9cb21b2b612a3b89a258afd1e288bb519880bdfce011a3f481f903537dc8141c5c7e776ecc889e9a485d9dceabc31b2cb1272fd426d8e

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+*   Correctly escape PostgreSQL arrays.
+
+    Fixes: CVE-2014-0080
+
 *   `Relation` no longer has mutator methods like `#map!` and `#delete_if`. Convert
     to an `Array` by calling `#to_a` before using these methods.
 

data/lib/active_record/connection_adapters/postgresql/cast.rb

@@ -142,12 +142,16 @@ module ActiveRecord
             end
           end
 
+          ARRAY_ESCAPE = "\\" * 2 * 2 # escape the backslash twice for PG arrays
+
           def quote_and_escape(value)
             case value
             when "NULL"
               value
             else
-              "\"#{value.gsub(/"/,"\\\"")}\""
+              value = value.gsub(/\\/, ARRAY_ESCAPE)
+              value.gsub!(/"/,"\\\"")
+              "\"#{value}\""
             end
           end
 

data/lib/active_record/version.rb

@@ -1,7 +1,7 @@
 module ActiveRecord
   # Returns the version of the currently loaded ActiveRecord as a Gem::Version
   def self.version
-    Gem::Version.new "4.1.0.beta1"
+    Gem::Version.new "4.1.0.beta2"
   end
 
   module VERSION #:nodoc:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 4.1.0.beta1
+  version: 4.1.0.beta2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-18 00:00:00.000000000 Z
+date: 2014-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,40 +16,40 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.1.0.beta1
+        version: 4.1.0.beta2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.1.0.beta1
+        version: 4.1.0.beta2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.1.0.beta1
+        version: 4.1.0.beta2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.1.0.beta1
+        version: 4.1.0.beta2
 - !ruby/object:Gem::Dependency
   name: arel
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 5.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 5.0.0
 description: Databases on Rails. Build a persistent domain model by mapping database
@@ -66,8 +66,10 @@ files:
 - README.rdoc
 - examples/performance.rb
 - examples/simple.rb
+- lib/active_record.rb
 - lib/active_record/aggregations.rb
 - lib/active_record/association_relation.rb
+- lib/active_record/associations.rb
 - lib/active_record/associations/alias_tracker.rb
 - lib/active_record/associations/association.rb
 - lib/active_record/associations/association_scope.rb
@@ -86,11 +88,12 @@ files:
 - lib/active_record/associations/has_many_through_association.rb
 - lib/active_record/associations/has_one_association.rb
 - lib/active_record/associations/has_one_through_association.rb
+- lib/active_record/associations/join_dependency.rb
 - lib/active_record/associations/join_dependency/join_association.rb
 - lib/active_record/associations/join_dependency/join_base.rb
 - lib/active_record/associations/join_dependency/join_part.rb
-- lib/active_record/associations/join_dependency.rb
 - lib/active_record/associations/join_helper.rb
+- lib/active_record/associations/preloader.rb
 - lib/active_record/associations/preloader/association.rb
 - lib/active_record/associations/preloader/belongs_to.rb
 - lib/active_record/associations/preloader/collection_association.rb
@@ -100,11 +103,10 @@ files:
 - lib/active_record/associations/preloader/has_one_through.rb
 - lib/active_record/associations/preloader/singular_association.rb
 - lib/active_record/associations/preloader/through_association.rb
-- lib/active_record/associations/preloader.rb
 - lib/active_record/associations/singular_association.rb
 - lib/active_record/associations/through_association.rb
-- lib/active_record/associations.rb
 - lib/active_record/attribute_assignment.rb
+- lib/active_record/attribute_methods.rb
 - lib/active_record/attribute_methods/before_type_cast.rb
 - lib/active_record/attribute_methods/dirty.rb
 - lib/active_record/attribute_methods/primary_key.rb
@@ -113,7 +115,6 @@ files:
 - lib/active_record/attribute_methods/serialization.rb
 - lib/active_record/attribute_methods/time_zone_conversion.rb
 - lib/active_record/attribute_methods/write.rb
-- lib/active_record/attribute_methods.rb
 - lib/active_record/autosave_association.rb
 - lib/active_record/base.rb
 - lib/active_record/callbacks.rb
@@ -163,9 +164,9 @@ files:
 - lib/active_record/locking/optimistic.rb
 - lib/active_record/locking/pessimistic.rb
 - lib/active_record/log_subscriber.rb
+- lib/active_record/migration.rb
 - lib/active_record/migration/command_recorder.rb
 - lib/active_record/migration/join_table.rb
-- lib/active_record/migration.rb
 - lib/active_record/model_schema.rb
 - lib/active_record/nested_attributes.rb
 - lib/active_record/no_touching.rb
@@ -180,26 +181,26 @@ files:
 - lib/active_record/railties/jdbcmysql_error.rb
 - lib/active_record/readonly_attributes.rb
 - lib/active_record/reflection.rb
+- lib/active_record/relation.rb
 - lib/active_record/relation/batches.rb
 - lib/active_record/relation/calculations.rb
 - lib/active_record/relation/delegation.rb
 - lib/active_record/relation/finder_methods.rb
 - lib/active_record/relation/merger.rb
+- lib/active_record/relation/predicate_builder.rb
 - lib/active_record/relation/predicate_builder/array_handler.rb
 - lib/active_record/relation/predicate_builder/relation_handler.rb
-- lib/active_record/relation/predicate_builder.rb
 - lib/active_record/relation/query_methods.rb
 - lib/active_record/relation/spawn_methods.rb
-- lib/active_record/relation.rb
 - lib/active_record/result.rb
 - lib/active_record/runtime_registry.rb
 - lib/active_record/sanitization.rb
 - lib/active_record/schema.rb
 - lib/active_record/schema_dumper.rb
 - lib/active_record/schema_migration.rb
+- lib/active_record/scoping.rb
 - lib/active_record/scoping/default.rb
 - lib/active_record/scoping/named.rb
-- lib/active_record/scoping.rb
 - lib/active_record/serialization.rb
 - lib/active_record/serializers/xml_serializer.rb
 - lib/active_record/statement_cache.rb
@@ -211,43 +212,42 @@ files:
 - lib/active_record/timestamp.rb
 - lib/active_record/transactions.rb
 - lib/active_record/translation.rb
+- lib/active_record/validations.rb
 - lib/active_record/validations/associated.rb
 - lib/active_record/validations/presence.rb
 - lib/active_record/validations/uniqueness.rb
-- lib/active_record/validations.rb
 - lib/active_record/version.rb
-- lib/active_record.rb
+- lib/rails/generators/active_record.rb
+- lib/rails/generators/active_record/migration.rb
 - lib/rails/generators/active_record/migration/migration_generator.rb
 - lib/rails/generators/active_record/migration/templates/create_table_migration.rb
 - lib/rails/generators/active_record/migration/templates/migration.rb
-- lib/rails/generators/active_record/migration.rb
 - lib/rails/generators/active_record/model/model_generator.rb
 - lib/rails/generators/active_record/model/templates/model.rb
 - lib/rails/generators/active_record/model/templates/module.rb
-- lib/rails/generators/active_record.rb
 homepage: http://www.rubyonrails.org
 licenses:
 - MIT
 metadata: {}
 post_install_message: 
 rdoc_options:
-- --main
+- "--main"
 - README.rdoc
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>'
+  - - ">"
     - !ruby/object:Gem::Version
       version: 1.3.1
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.2.0
 signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).