activerecord 5.1.0 → 5.2.3

data/lib/active_record/relation/record_fetch_warning.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   class Relation
     module RecordFetchWarning

data/lib/active_record/relation/spawn_methods.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/hash/except"
 require "active_support/core_ext/hash/slice"
 require "active_record/relation/merger"
@@ -6,7 +8,7 @@ module ActiveRecord
   module SpawnMethods
     # This is overridden by Associations::CollectionProxy
     def spawn #:nodoc:
-      clone
+      @delegate_to_klass ? klass.all : clone
     end
 
     # Merges in the conditions from <tt>other</tt>, if <tt>other</tt> is an ActiveRecord::Relation.
@@ -67,7 +69,7 @@ module ActiveRecord
     private
 
       def relation_with(values)
-        result = Relation.create(klass, table, predicate_builder, values)
+        result = Relation.create(klass, values: values)
         result.extend(*extending_values) if extending_values.any?
         result
       end

data/lib/active_record/relation/where_clause.rb

@@ -1,65 +1,63 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   class Relation
     class WhereClause # :nodoc:
-      attr_reader :binds
-
       delegate :any?, :empty?, to: :predicates
 
-      def initialize(predicates, binds)
+      def initialize(predicates)
         @predicates = predicates
-        @binds = binds
       end
 
       def +(other)
         WhereClause.new(
           predicates + other.predicates,
-          binds + other.binds,
+        )
+      end
+
+      def -(other)
+        WhereClause.new(
+          predicates - other.predicates,
         )
       end
 
       def merge(other)
         WhereClause.new(
           predicates_unreferenced_by(other) + other.predicates,
-          non_conflicting_binds(other) + other.binds,
         )
       end
 
       def except(*columns)
-        WhereClause.new(*except_predicates_and_binds(columns))
+        WhereClause.new(except_predicates(columns))
       end
 
       def or(other)
-        if empty?
-          self
-        elsif other.empty?
-          other
+        left = self - other
+        common = self - left
+        right = other - common
+
+        if left.empty? || right.empty?
+          common
         else
-          WhereClause.new(
-            [ast.or(other.ast)],
-            binds + other.binds
+          or_clause = WhereClause.new(
+            [left.ast.or(right.ast)],
           )
+          common + or_clause
         end
       end
 
       def to_h(table_name = nil)
-        equalities = predicates.grep(Arel::Nodes::Equality)
+        equalities = equalities(predicates)
         if table_name
           equalities = equalities.select do |node|
             node.left.relation.name == table_name
           end
         end
 
-        binds = self.binds.map { |attr| [attr.name, attr.value] }.to_h
-
         equalities.map { |node|
-          name = node.left.name
-          [name, binds.fetch(name.to_s) {
-            case node.right
-            when Array then node.right.map(&:val)
-            when Arel::Nodes::Casted, Arel::Nodes::Quoted
-              node.right.val
-            end
-          }]
+          name = node.left.name.to_s
+          value = extract_node_value(node.right)
+          [name, value]
         }.to_h
       end
 
@@ -69,20 +67,17 @@ module ActiveRecord
 
       def ==(other)
         other.is_a?(WhereClause) &&
-          predicates == other.predicates &&
-          binds == other.binds
+          predicates == other.predicates
       end
 
       def invert
-        WhereClause.new(inverted_predicates, binds)
+        WhereClause.new(inverted_predicates)
       end
 
       def self.empty
-        @empty ||= new([], [])
+        @empty ||= new([])
       end
 
-      # TODO Change this to private once we've dropped Ruby 2.2 support.
-      # Workaround for Ruby 2.2 "private attribute?" warning.
       protected
 
         attr_reader :predicates
@@ -95,6 +90,20 @@ module ActiveRecord
         end
 
       private
+        def equalities(predicates)
+          equalities = []
+
+          predicates.each do |node|
+            case node
+            when Arel::Nodes::Equality
+              equalities << node
+            when Arel::Nodes::And
+              equalities.concat equalities(node.children)
+            end
+          end
+
+          equalities
+        end
 
         def predicates_unreferenced_by(other)
           predicates.reject do |n|
@@ -106,12 +115,6 @@ module ActiveRecord
           node.respond_to?(:operator) && node.operator == :==
         end
 
-        def non_conflicting_binds(other)
-          conflicts = referenced_columns & other.referenced_columns
-          conflicts.map! { |node| node.name.to_s }
-          binds.reject { |attr| conflicts.include?(attr.name) }
-        end
-
         def inverted_predicates
           predicates.map { |node| invert_predicate(node) }
         end
@@ -131,43 +134,22 @@ module ActiveRecord
           end
         end
 
-        def except_predicates_and_binds(columns)
-          except_binds = []
-          binds_index = 0
-
-          predicates = self.predicates.reject do |node|
-            except = \
-              case node
-              when Arel::Nodes::Between, Arel::Nodes::In, Arel::Nodes::NotIn, Arel::Nodes::Equality, Arel::Nodes::NotEqual, Arel::Nodes::LessThan, Arel::Nodes::LessThanOrEqual, Arel::Nodes::GreaterThan, Arel::Nodes::GreaterThanOrEqual
-                binds_contains = node.grep(Arel::Nodes::BindParam).size
-                subrelation = (node.left.kind_of?(Arel::Attributes::Attribute) ? node.left : node.right)
-                columns.include?(subrelation.name.to_s)
-              end
-
-            if except && binds_contains > 0
-              (binds_index...(binds_index + binds_contains)).each do |i|
-                except_binds[i] = true
-              end
+        def except_predicates(columns)
+          predicates.reject do |node|
+            case node
+            when Arel::Nodes::Between, Arel::Nodes::In, Arel::Nodes::NotIn, Arel::Nodes::Equality, Arel::Nodes::NotEqual, Arel::Nodes::LessThan, Arel::Nodes::LessThanOrEqual, Arel::Nodes::GreaterThan, Arel::Nodes::GreaterThanOrEqual
+              subrelation = (node.left.kind_of?(Arel::Attributes::Attribute) ? node.left : node.right)
+              columns.include?(subrelation.name.to_s)
             end
-
-            binds_index += binds_contains if binds_contains
-
-            except
           end
-
-          binds = self.binds.reject.with_index do |_, i|
-            except_binds[i]
-          end
-
-          [predicates, binds]
         end
 
         def predicates_with_wrapped_sql_literals
           non_empty_predicates.map do |node|
-            if Arel::Nodes::Equality === node
-              node
-            else
+            case node
+            when Arel::Nodes::SqlLiteral, ::String
               wrap_sql_literal(node)
+            else node
             end
           end
         end
@@ -183,6 +165,22 @@ module ActiveRecord
           end
           Arel::Nodes::Grouping.new(node)
         end
+
+        def extract_node_value(node)
+          case node
+          when Array
+            node.map { |v| extract_node_value(v) }
+          when Arel::Nodes::Casted, Arel::Nodes::Quoted
+            node.val
+          when Arel::Nodes::BindParam
+            value = node.value
+            if value.respond_to?(:value_before_type_cast)
+              value.value_before_type_cast
+            else
+              value
+            end
+          end
+        end
     end
   end
 end

data/lib/active_record/relation/where_clause_factory.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   class Relation
     class WhereClauseFactory # :nodoc:
@@ -9,69 +11,24 @@ module ActiveRecord
       def build(opts, other)
         case opts
         when String, Array
-          parts = [klass.send(:sanitize_sql, other.empty? ? opts : ([opts] + other))]
+          parts = [klass.sanitize_sql(other.empty? ? opts : ([opts] + other))]
         when Hash
           attributes = predicate_builder.resolve_column_aliases(opts)
-          attributes = klass.send(:expand_hash_conditions_for_aggregates, attributes)
           attributes.stringify_keys!
 
-          if perform_case_sensitive?(options = other.last)
-            parts, binds = build_for_case_sensitive(attributes, options)
-          else
-            attributes, binds = predicate_builder.create_binds(attributes)
-            parts = predicate_builder.build_from_hash(attributes)
-          end
+          parts = predicate_builder.build_from_hash(attributes)
         when Arel::Nodes::Node
           parts = [opts]
         else
           raise ArgumentError, "Unsupported argument type: #{opts} (#{opts.class})"
         end
 
-        WhereClause.new(parts, binds || [])
+        WhereClause.new(parts)
       end
 
-      # TODO Change this to private once we've dropped Ruby 2.2 support.
-      # Workaround for Ruby 2.2 "private attribute?" warning.
       protected
 
         attr_reader :klass, :predicate_builder
-
-      private
-
-        def perform_case_sensitive?(options)
-          options && options.key?(:case_sensitive)
-        end
-
-        def build_for_case_sensitive(attributes, options)
-          parts, binds = [], []
-          table = klass.arel_table
-
-          attributes.each do |attribute, value|
-            if reflection = klass._reflect_on_association(attribute)
-              attribute = reflection.foreign_key.to_s
-              value = value[reflection.klass.primary_key] unless value.nil?
-            end
-
-            if value.nil?
-              parts << table[attribute].eq(value)
-            else
-              column = klass.column_for_attribute(attribute)
-
-              binds << predicate_builder.send(:build_bind_param, attribute, value)
-              value = Arel::Nodes::BindParam.new
-
-              predicate = if options[:case_sensitive]
-                klass.connection.case_sensitive_comparison(table, attribute, column, value)
-              else
-                klass.connection.case_insensitive_comparison(table, attribute, column, value)
-              end
-
-              parts << predicate
-            end
-          end
-
-          [parts, binds]
-        end
     end
   end
 end

data/lib/active_record/result.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   ###
   # This class encapsulates a result returned from calling

data/lib/active_record/runtime_registry.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/per_thread_registry"
 
 module ActiveRecord

data/lib/active_record/sanitization.rb

@@ -1,74 +1,139 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   module Sanitization
     extend ActiveSupport::Concern
 
     module ClassMethods
-      private
+      # Accepts an array or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for a WHERE clause.
+      #
+      #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      #
+      #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      #
+      #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
+      #   # => "name='foo''bar' and group_id='4'"
+      def sanitize_sql_for_conditions(condition)
+        return nil if condition.blank?
 
-        # Accepts an array or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for a WHERE clause.
-        #
-        #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        #
-        #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        #
-        #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
-        #   # => "name='foo''bar' and group_id='4'"
-        def sanitize_sql_for_conditions(condition) # :doc:
-          return nil if condition.blank?
-
-          case condition
-          when Array; sanitize_sql_array(condition)
-          else        condition
-          end
+        case condition
+        when Array; sanitize_sql_array(condition)
+        else        condition
         end
-        alias :sanitize_sql :sanitize_sql_for_conditions
-        alias :sanitize_conditions :sanitize_sql
-        deprecate sanitize_conditions: :sanitize_sql
+      end
+      alias :sanitize_sql :sanitize_sql_for_conditions
 
-        # Accepts an array, hash, or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for a SET clause.
-        #
-        #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
-        #   # => "name=NULL and group_id=4"
-        #
-        #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
-        #   # => "name=NULL and group_id=4"
-        #
-        #   Post.send(:sanitize_sql_for_assignment, { name: nil, group_id: 4 })
-        #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
-        #
-        #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
-        #   # => "name=NULL and group_id='4'"
-        def sanitize_sql_for_assignment(assignments, default_table_name = table_name) # :doc:
-          case assignments
-          when Array; sanitize_sql_array(assignments)
-          when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
-          else        assignments
-          end
+      # Accepts an array, hash, or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for a SET clause.
+      #
+      #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
+      #   # => "name=NULL and group_id=4"
+      #
+      #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
+      #   # => "name=NULL and group_id=4"
+      #
+      #   Post.sanitize_sql_for_assignment({ name: nil, group_id: 4 })
+      #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
+      #
+      #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
+      #   # => "name=NULL and group_id='4'"
+      def sanitize_sql_for_assignment(assignments, default_table_name = table_name)
+        case assignments
+        when Array; sanitize_sql_array(assignments)
+        when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
+        else        assignments
         end
+      end
 
-        # Accepts an array, or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for an ORDER clause.
-        #
-        #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
-        #   # => "field(id, 1,3,2)"
-        #
-        #   sanitize_sql_for_order("id ASC")
-        #   # => "id ASC"
-        def sanitize_sql_for_order(condition) # :doc:
-          if condition.is_a?(Array) && condition.first.to_s.include?("?")
-            sanitize_sql_array(condition)
-          else
-            condition
+      # Accepts an array, or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for an ORDER clause.
+      #
+      #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
+      #   # => "field(id, 1,3,2)"
+      #
+      #   sanitize_sql_for_order("id ASC")
+      #   # => "id ASC"
+      def sanitize_sql_for_order(condition)
+        if condition.is_a?(Array) && condition.first.to_s.include?("?")
+          enforce_raw_sql_whitelist([condition.first],
+            whitelist: AttributeMethods::ClassMethods::COLUMN_NAME_ORDER_WHITELIST
+          )
+
+          # Ensure we aren't dealing with a subclass of String that might
+          # override methods we use (eg. Arel::Nodes::SqlLiteral).
+          if condition.first.kind_of?(String) && !condition.first.instance_of?(String)
+            condition = [String.new(condition.first), *condition[1..-1]]
           end
+
+          Arel.sql(sanitize_sql_array(condition))
+        else
+          condition
+        end
+      end
+
+      # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
+      #
+      #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
+      #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
+      def sanitize_sql_hash_for_assignment(attrs, table)
+        c = connection
+        attrs.map do |attr, value|
+          type = type_for_attribute(attr)
+          value = type.serialize(type.cast(value))
+          "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
+        end.join(", ")
+      end
+
+      # Sanitizes a +string+ so that it is safe to use within an SQL
+      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
+      #
+      #   sanitize_sql_like("100%")
+      #   # => "100\\%"
+      #
+      #   sanitize_sql_like("snake_cased_string")
+      #   # => "snake\\_cased\\_string"
+      #
+      #   sanitize_sql_like("100%", "!")
+      #   # => "100!%"
+      #
+      #   sanitize_sql_like("snake_cased_string", "!")
+      #   # => "snake!_cased!_string"
+      def sanitize_sql_like(string, escape_character = "\\")
+        pattern = Regexp.union(escape_character, "%", "_")
+        string.gsub(pattern) { |x| [escape_character, x].join }
+      end
+
+      # Accepts an array of conditions. The array has each value
+      # sanitized and interpolated into the SQL statement.
+      #
+      #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      def sanitize_sql_array(ary)
+        statement, *values = ary
+        if values.first.is_a?(Hash) && /:\w+/.match?(statement)
+          replace_named_bind_variables(statement, values.first)
+        elsif statement.include?("?")
+          replace_bind_variables(statement, values)
+        elsif statement.blank?
+          statement
+        else
+          statement % values.collect { |value| connection.quote_string(value.to_s) }
         end
+      end
 
+      private
         # Accepts a hash of SQL conditions and replaces those attributes
         # that correspond to a {#composed_of}[rdoc-ref:Aggregations::ClassMethods#composed_of]
         # relationship with their expanded aggregate attribute values.
@@ -90,10 +155,12 @@ module ActiveRecord
             if aggregation = reflect_on_aggregation(attr.to_sym)
               mapping = aggregation.mapping
               mapping.each do |field_attr, aggregate_attr|
-                if mapping.size == 1 && !value.respond_to?(aggregate_attr)
-                  expanded_attrs[field_attr] = value
+                expanded_attrs[field_attr] = if value.is_a?(Array)
+                  value.map { |it| it.send(aggregate_attr) }
+                elsif mapping.size == 1 && !value.respond_to?(aggregate_attr)
+                  value
                 else
-                  expanded_attrs[field_attr] = value.send(aggregate_attr)
+                  value.send(aggregate_attr)
                 end
               end
             else
@@ -102,61 +169,7 @@ module ActiveRecord
           end
           expanded_attrs
         end
-
-        # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
-        #
-        #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
-        #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
-        def sanitize_sql_hash_for_assignment(attrs, table) # :doc:
-          c = connection
-          attrs.map do |attr, value|
-            value = type_for_attribute(attr.to_s).serialize(value)
-            "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
-          end.join(", ")
-        end
-
-        # Sanitizes a +string+ so that it is safe to use within an SQL
-        # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
-        #
-        #   sanitize_sql_like("100%")
-        #   # => "100\\%"
-        #
-        #   sanitize_sql_like("snake_cased_string")
-        #   # => "snake\\_cased\\_string"
-        #
-        #   sanitize_sql_like("100%", "!")
-        #   # => "100!%"
-        #
-        #   sanitize_sql_like("snake_cased_string", "!")
-        #   # => "snake!_cased!_string"
-        def sanitize_sql_like(string, escape_character = "\\") # :doc:
-          pattern = Regexp.union(escape_character, "%", "_")
-          string.gsub(pattern) { |x| [escape_character, x].join }
-        end
-
-        # Accepts an array of conditions. The array has each value
-        # sanitized and interpolated into the SQL statement.
-        #
-        #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        def sanitize_sql_array(ary) # :doc:
-          statement, *values = ary
-          if values.first.is_a?(Hash) && /:\w+/.match?(statement)
-            replace_named_bind_variables(statement, values.first)
-          elsif statement.include?("?")
-            replace_bind_variables(statement, values)
-          elsif statement.blank?
-            statement
-          else
-            statement % values.collect { |value| connection.quote_string(value.to_s) }
-          end
-        end
+        deprecate :expand_hash_conditions_for_aggregates
 
         def replace_bind_variables(statement, values)
           raise_if_bind_arity_mismatch(statement, statement.count("?"), values.size)
@@ -205,10 +218,5 @@ module ActiveRecord
           end
         end
     end
-
-    def quoted_id # :nodoc:
-      self.class.connection.quote(@attributes[self.class.primary_key].value_for_database)
-    end
-    deprecate :quoted_id
   end
 end