activerecord 5.1.7 → 5.2.0

data/lib/active_record/sanitization.rb

@@ -1,74 +1,139 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   module Sanitization
     extend ActiveSupport::Concern
 
     module ClassMethods
-      private
+      # Accepts an array or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for a WHERE clause.
+      #
+      #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      #
+      #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      #
+      #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
+      #   # => "name='foo''bar' and group_id='4'"
+      def sanitize_sql_for_conditions(condition)
+        return nil if condition.blank?
 
-        # Accepts an array or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for a WHERE clause.
-        #
-        #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        #
-        #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        #
-        #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
-        #   # => "name='foo''bar' and group_id='4'"
-        def sanitize_sql_for_conditions(condition) # :doc:
-          return nil if condition.blank?
-
-          case condition
-          when Array; sanitize_sql_array(condition)
-          else        condition
-          end
+        case condition
+        when Array; sanitize_sql_array(condition)
+        else        condition
         end
-        alias :sanitize_sql :sanitize_sql_for_conditions
-        alias :sanitize_conditions :sanitize_sql
-        deprecate sanitize_conditions: :sanitize_sql
+      end
+      alias :sanitize_sql :sanitize_sql_for_conditions
 
-        # Accepts an array, hash, or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for a SET clause.
-        #
-        #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
-        #   # => "name=NULL and group_id=4"
-        #
-        #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
-        #   # => "name=NULL and group_id=4"
-        #
-        #   Post.send(:sanitize_sql_for_assignment, { name: nil, group_id: 4 })
-        #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
-        #
-        #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
-        #   # => "name=NULL and group_id='4'"
-        def sanitize_sql_for_assignment(assignments, default_table_name = table_name) # :doc:
-          case assignments
-          when Array; sanitize_sql_array(assignments)
-          when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
-          else        assignments
-          end
+      # Accepts an array, hash, or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for a SET clause.
+      #
+      #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
+      #   # => "name=NULL and group_id=4"
+      #
+      #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
+      #   # => "name=NULL and group_id=4"
+      #
+      #   Post.sanitize_sql_for_assignment({ name: nil, group_id: 4 })
+      #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
+      #
+      #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
+      #   # => "name=NULL and group_id='4'"
+      def sanitize_sql_for_assignment(assignments, default_table_name = table_name)
+        case assignments
+        when Array; sanitize_sql_array(assignments)
+        when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
+        else        assignments
         end
+      end
 
-        # Accepts an array, or string of SQL conditions and sanitizes
-        # them into a valid SQL fragment for an ORDER clause.
-        #
-        #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
-        #   # => "field(id, 1,3,2)"
-        #
-        #   sanitize_sql_for_order("id ASC")
-        #   # => "id ASC"
-        def sanitize_sql_for_order(condition) # :doc:
-          if condition.is_a?(Array) && condition.first.to_s.include?("?")
-            sanitize_sql_array(condition)
-          else
-            condition
+      # Accepts an array, or string of SQL conditions and sanitizes
+      # them into a valid SQL fragment for an ORDER clause.
+      #
+      #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
+      #   # => "field(id, 1,3,2)"
+      #
+      #   sanitize_sql_for_order("id ASC")
+      #   # => "id ASC"
+      def sanitize_sql_for_order(condition)
+        if condition.is_a?(Array) && condition.first.to_s.include?("?")
+          enforce_raw_sql_whitelist([condition.first],
+            whitelist: AttributeMethods::ClassMethods::COLUMN_NAME_ORDER_WHITELIST
+          )
+
+          # Ensure we aren't dealing with a subclass of String that might
+          # override methods we use (eg. Arel::Nodes::SqlLiteral).
+          if condition.first.kind_of?(String) && !condition.first.instance_of?(String)
+            condition = [String.new(condition.first), *condition[1..-1]]
           end
+
+          Arel.sql(sanitize_sql_array(condition))
+        else
+          condition
+        end
+      end
+
+      # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
+      #
+      #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
+      #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
+      def sanitize_sql_hash_for_assignment(attrs, table)
+        c = connection
+        attrs.map do |attr, value|
+          type = type_for_attribute(attr)
+          value = type.serialize(type.cast(value))
+          "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
+        end.join(", ")
+      end
+
+      # Sanitizes a +string+ so that it is safe to use within an SQL
+      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
+      #
+      #   sanitize_sql_like("100%")
+      #   # => "100\\%"
+      #
+      #   sanitize_sql_like("snake_cased_string")
+      #   # => "snake\\_cased\\_string"
+      #
+      #   sanitize_sql_like("100%", "!")
+      #   # => "100!%"
+      #
+      #   sanitize_sql_like("snake_cased_string", "!")
+      #   # => "snake!_cased!_string"
+      def sanitize_sql_like(string, escape_character = "\\")
+        pattern = Regexp.union(escape_character, "%", "_")
+        string.gsub(pattern) { |x| [escape_character, x].join }
+      end
+
+      # Accepts an array of conditions. The array has each value
+      # sanitized and interpolated into the SQL statement.
+      #
+      #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+      #   # => "name='foo''bar' and group_id=4"
+      #
+      #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
+      #   # => "name='foo''bar' and group_id='4'"
+      def sanitize_sql_array(ary)
+        statement, *values = ary
+        if values.first.is_a?(Hash) && /:\w+/.match?(statement)
+          replace_named_bind_variables(statement, values.first)
+        elsif statement.include?("?")
+          replace_bind_variables(statement, values)
+        elsif statement.blank?
+          statement
+        else
+          statement % values.collect { |value| connection.quote_string(value.to_s) }
         end
+      end
 
+      private
         # Accepts a hash of SQL conditions and replaces those attributes
         # that correspond to a {#composed_of}[rdoc-ref:Aggregations::ClassMethods#composed_of]
         # relationship with their expanded aggregate attribute values.
@@ -90,10 +155,12 @@ module ActiveRecord
             if aggregation = reflect_on_aggregation(attr.to_sym)
               mapping = aggregation.mapping
               mapping.each do |field_attr, aggregate_attr|
-                if mapping.size == 1 && !value.respond_to?(aggregate_attr)
-                  expanded_attrs[field_attr] = value
+                expanded_attrs[field_attr] = if value.is_a?(Array)
+                  value.map { |it| it.send(aggregate_attr) }
+                elsif mapping.size == 1 && !value.respond_to?(aggregate_attr)
+                  value
                 else
-                  expanded_attrs[field_attr] = value.send(aggregate_attr)
+                  value.send(aggregate_attr)
                 end
               end
             else
@@ -102,61 +169,7 @@ module ActiveRecord
           end
           expanded_attrs
         end
-
-        # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
-        #
-        #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
-        #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
-        def sanitize_sql_hash_for_assignment(attrs, table) # :doc:
-          c = connection
-          attrs.map do |attr, value|
-            value = type_for_attribute(attr.to_s).serialize(value)
-            "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
-          end.join(", ")
-        end
-
-        # Sanitizes a +string+ so that it is safe to use within an SQL
-        # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
-        #
-        #   sanitize_sql_like("100%")
-        #   # => "100\\%"
-        #
-        #   sanitize_sql_like("snake_cased_string")
-        #   # => "snake\\_cased\\_string"
-        #
-        #   sanitize_sql_like("100%", "!")
-        #   # => "100!%"
-        #
-        #   sanitize_sql_like("snake_cased_string", "!")
-        #   # => "snake!_cased!_string"
-        def sanitize_sql_like(string, escape_character = "\\") # :doc:
-          pattern = Regexp.union(escape_character, "%", "_")
-          string.gsub(pattern) { |x| [escape_character, x].join }
-        end
-
-        # Accepts an array of conditions. The array has each value
-        # sanitized and interpolated into the SQL statement.
-        #
-        #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-        #   # => "name='foo''bar' and group_id=4"
-        #
-        #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
-        #   # => "name='foo''bar' and group_id='4'"
-        def sanitize_sql_array(ary) # :doc:
-          statement, *values = ary
-          if values.first.is_a?(Hash) && /:\w+/.match?(statement)
-            replace_named_bind_variables(statement, values.first)
-          elsif statement.include?("?")
-            replace_bind_variables(statement, values)
-          elsif statement.blank?
-            statement
-          else
-            statement % values.collect { |value| connection.quote_string(value.to_s) }
-          end
-        end
+        deprecate :expand_hash_conditions_for_aggregates
 
         def replace_bind_variables(statement, values)
           raise_if_bind_arity_mismatch(statement, statement.count("?"), values.size)
@@ -205,10 +218,5 @@ module ActiveRecord
           end
         end
     end
-
-    def quoted_id # :nodoc:
-      self.class.connection.quote(@attributes[self.class.primary_key].value_for_database)
-    end
-    deprecate :quoted_id
   end
 end

data/lib/active_record/schema.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   # = Active Record \Schema
   #
@@ -37,7 +39,7 @@ module ActiveRecord
     # The +info+ hash is optional, and if given is used to define metadata
     # about the current schema (currently, only the schema's version):
     #
-    #   ActiveRecord::Schema.define(version: 20380119000001) do
+    #   ActiveRecord::Schema.define(version: 2038_01_19_000001) do
     #     ...
     #   end
     def self.define(info = {}, &block)
@@ -53,7 +55,7 @@ module ActiveRecord
       end
 
       ActiveRecord::InternalMetadata.create_table
-      ActiveRecord::InternalMetadata[:environment] = ActiveRecord::Migrator.current_environment
+      ActiveRecord::InternalMetadata[:environment] = connection.migration_context.current_environment
     end
 
     private

data/lib/active_record/schema_dumper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "stringio"
 
 module ActiveRecord
@@ -11,14 +13,13 @@ module ActiveRecord
     ##
     # :singleton-method:
     # A list of tables which should not be dumped to the schema.
-    # Acceptable values are strings as well as regexp.
-    # This setting is only used if ActiveRecord::Base.schema_format == :ruby
-    cattr_accessor :ignore_tables
-    @@ignore_tables = []
+    # Acceptable values are strings as well as regexp if ActiveRecord::Base.schema_format == :ruby.
+    # Only strings are accepted if ActiveRecord::Base.schema_format == :sql.
+    cattr_accessor :ignore_tables, default: []
 
     class << self
       def dump(connection = ActiveRecord::Base.connection, stream = STDOUT, config = ActiveRecord::Base)
-        new(connection, generate_options(config)).dump(stream)
+        connection.create_schema_dumper(generate_options(config)).dump(stream)
         stream
       end
 
@@ -43,13 +44,22 @@ module ActiveRecord
 
       def initialize(connection, options = {})
         @connection = connection
-        @version = Migrator::current_version rescue nil
+        @version = connection.migration_context.current_version rescue nil
         @options = options
       end
 
-      def header(stream)
-        define_params = @version ? "version: #{@version}" : ""
+      # turns 20170404131909 into "2017_04_04_131909"
+      def formatted_version
+        stringified = @version.to_s
+        return stringified unless stringified.length == 14
+        stringified.insert(4, "_").insert(7, "_").insert(10, "_")
+      end
 
+      def define_params
+        @version ? "version: #{formatted_version}" : ""
+      end
+
+      def header(stream)
         stream.puts <<HEADER
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
@@ -72,16 +82,8 @@ HEADER
         stream.puts "end"
       end
 
+      # extensions are only supported by PostgreSQL
       def extensions(stream)
-        return unless @connection.supports_extensions?
-        extensions = @connection.extensions
-        if extensions.any?
-          stream.puts "  # These are extensions that must be enabled in order to support this database"
-          extensions.each do |extension|
-            stream.puts "  enable_extension #{extension.inspect}"
-          end
-          stream.puts
-        end
       end
 
       def tables(stream)
@@ -113,7 +115,7 @@ HEADER
           when String
             tbl.print ", primary_key: #{pk.inspect}" unless pk == "id"
             pkcol = columns.detect { |c| c.name == pk }
-            pkcolspec = @connection.column_spec_for_primary_key(pkcol)
+            pkcolspec = column_spec_for_primary_key(pkcol)
             if pkcolspec.present?
               tbl.print ", #{format_colspec(pkcolspec)}"
             end
@@ -122,20 +124,19 @@ HEADER
           else
             tbl.print ", id: false"
           end
-          tbl.print ", force: :cascade"
 
           table_options = @connection.table_options(table)
           if table_options.present?
             tbl.print ", #{format_options(table_options)}"
           end
 
-          tbl.puts " do |t|"
+          tbl.puts ", force: :cascade do |t|"
 
           # then dump all non-primary key columns
           columns.each do |column|
             raise StandardError, "Unknown type '#{column.sql_type}' for column '#{column.name}'" unless @connection.valid_type?(column.type)
             next if column.name == pk
-            type, colspec = @connection.column_spec(column)
+            type, colspec = column_spec(column)
             tbl.print "    t.#{type} #{column.name.inspect}"
             tbl.print ", #{format_colspec(colspec)}" if colspec.present?
             tbl.puts
@@ -153,8 +154,6 @@ HEADER
           stream.puts "#   #{e.message}"
           stream.puts
         end
-
-        stream
       end
 
       # Keep it for indexing materialized views
@@ -185,8 +184,9 @@ HEADER
           "name: #{index.name.inspect}",
         ]
         index_parts << "unique: true" if index.unique
-        index_parts << "length: { #{format_options(index.lengths)} }" if index.lengths.present?
-        index_parts << "order: { #{format_options(index.orders)} }" if index.orders.present?
+        index_parts << "length: #{format_index_parts(index.lengths)}" if index.lengths.present?
+        index_parts << "order: #{format_index_parts(index.orders)}" if index.orders.present?
+        index_parts << "opclass: #{format_index_parts(index.opclasses)}" if index.opclasses.present?
         index_parts << "where: #{index.where.inspect}" if index.where
         index_parts << "using: #{index.using.inspect}" if !@connection.default_index_type?(index)
         index_parts << "type: #{index.type.inspect}" if index.type
@@ -232,8 +232,18 @@ HEADER
         options.map { |key, value| "#{key}: #{value.inspect}" }.join(", ")
       end
 
+      def format_index_parts(options)
+        if options.is_a?(Hash)
+          "{ #{format_options(options)} }"
+        else
+          options.inspect
+        end
+      end
+
       def remove_prefix_and_suffix(table)
-        table.gsub(/^(#{@options[:table_name_prefix]})(.+)(#{@options[:table_name_suffix]})$/,  "\\2")
+        prefix = Regexp.escape(@options[:table_name_prefix].to_s)
+        suffix = Regexp.escape(@options[:table_name_suffix].to_s)
+        table.sub(/\A#{prefix}(.+)#{suffix}\z/, "\\1")
       end
 
       def ignored?(table_name)

data/lib/active_record/schema_migration.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_record/scoping/default"
 require "active_record/scoping/named"
 

data/lib/active_record/scoping/default.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   module Scoping
     module Default
@@ -5,11 +7,8 @@ module ActiveRecord
 
       included do
         # Stores the default scope for the class.
-        class_attribute :default_scopes, instance_writer: false, instance_predicate: false
-        class_attribute :default_scope_override, instance_writer: false, instance_predicate: false
-
-        self.default_scopes = []
-        self.default_scope_override = nil
+        class_attribute :default_scopes, instance_writer: false, instance_predicate: false, default: []
+        class_attribute :default_scope_override, instance_writer: false, instance_predicate: false, default: nil
       end
 
       module ClassMethods
@@ -112,7 +111,7 @@ module ActiveRecord
               # The user has defined their own default scope method, so call that
               evaluate_default_scope do
                 if scope = default_scope
-                  (base_rel ||= relation).merge(scope)
+                  (base_rel ||= relation).merge!(scope)
                 end
               end
             elsif default_scopes.any?
@@ -120,7 +119,7 @@ module ActiveRecord
               evaluate_default_scope do
                 default_scopes.inject(base_rel) do |default_scope, scope|
                   scope = scope.respond_to?(:to_proc) ? scope : scope.method(:call)
-                  default_scope.merge(base_rel.instance_exec(&scope))
+                  default_scope.merge!(base_rel.instance_exec(&scope))
                 end
               end
             end

data/lib/active_record/scoping/named.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/array"
 require "active_support/core_ext/hash/except"
 require "active_support/core_ext/kernel/singleton_class"
@@ -22,8 +24,14 @@ module ActiveRecord
         # You can define a scope that applies to all finders using
         # {default_scope}[rdoc-ref:Scoping::Default::ClassMethods#default_scope].
         def all
+          current_scope = self.current_scope
+
           if current_scope
-            current_scope.clone
+            if self == current_scope.klass
+              current_scope.clone
+            else
+              relation.merge!(current_scope)
+            end
           else
             default_scoped
           end
@@ -163,22 +171,28 @@ module ActiveRecord
               "a class method with the same name."
           end
 
+          if method_defined_within?(name, Relation)
+            raise ArgumentError, "You tried to define a scope named \"#{name}\" " \
+              "on the model \"#{self.name}\", but ActiveRecord::Relation already defined " \
+              "an instance method with the same name."
+          end
+
           valid_scope_name?(name)
           extension = Module.new(&block) if block
 
           if body.respond_to?(:to_proc)
             singleton_class.send(:define_method, name) do |*args|
-              scope = all.scoping { instance_exec(*args, &body) }
+              scope = all
+              scope = scope._exec_scope(*args, &body)
               scope = scope.extending(extension) if extension
-
-              scope || all
+              scope
             end
           else
             singleton_class.send(:define_method, name) do |*args|
-              scope = all.scoping { body.call(*args) }
+              scope = all
+              scope = scope.scoping { body.call(*args) || scope }
               scope = scope.extending(extension) if extension
-
-              scope || all
+              scope
             end
           end
         end

data/lib/active_record/scoping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/per_thread_registry"
 
 module ActiveRecord
@@ -9,23 +11,23 @@ module ActiveRecord
       include Named
     end
 
-    module ClassMethods
-      def current_scope(skip_inherited_scope = false) # :nodoc:
+    module ClassMethods # :nodoc:
+      def current_scope(skip_inherited_scope = false)
         ScopeRegistry.value_for(:current_scope, self, skip_inherited_scope)
       end
 
-      def current_scope=(scope) #:nodoc:
+      def current_scope=(scope)
         ScopeRegistry.set_value_for(:current_scope, self, scope)
       end
 
       # Collects attributes from scopes that should be applied when creating
       # an AR instance for the particular class this is called on.
-      def scope_attributes # :nodoc:
+      def scope_attributes
         all.scope_for_create
       end
 
       # Are there attributes associated with this scope?
-      def scope_attributes? # :nodoc:
+      def scope_attributes?
         current_scope
       end
     end
@@ -33,9 +35,8 @@ module ActiveRecord
     def populate_with_current_scope_attributes # :nodoc:
       return unless self.class.scope_attributes?
 
-      self.class.scope_attributes.each do |att, value|
-        send("#{att}=", value) if respond_to?("#{att}=")
-      end
+      attributes = self.class.scope_attributes
+      _assign_attributes(attributes) if attributes.any?
     end
 
     def initialize_internals_callback # :nodoc:

data/lib/active_record/secure_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord
   module SecureToken
     extend ActiveSupport::Concern

data/lib/active_record/serialization.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActiveRecord #:nodoc:
   # = Active Record \Serialization
   module Serialization