activerecord 5.2.0 → 5.2.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a81ce578a98474e193314f6d806ee2f910d9d651fab445a14595154c41f6401
-  data.tar.gz: 1a45823e0f6e0af4759af73c37e3a1b76bb9584e168b553bcfbca3208d2211e2
+  metadata.gz: 86737eb3187422c20dfc6d14b175ae9d541dfe670178da64a024c0968693ef81
+  data.tar.gz: 767900fd0d4a68dae1536cb7750e5456bc2bac72fde2ce7518ff69b1e5c8c706
 SHA512:
-  metadata.gz: f6390719d7140cda11b175cfb8c4ad62e502204a202a70d6bf532131f323b49f120c30ca8e28d9e35335bb03d52a596ae7dcdfb3b05e762ae78150c70625adae
-  data.tar.gz: cc85711ffcbec0a1b04b4f9940c0752687f9b98e7b65950cf46b28df14c13c9399d15699134bb3c5835bd76fdc8b944b0a661483c685075605b270f3bbe774d0
+  metadata.gz: 0af8b7124c2d152f219220f518615b135137bb610d747b520d9c28370c73c966110121c3bede44a3ca0b9c36a4650f7ed300548e658eda7c888f7298b2f45162
+  data.tar.gz: 1a72afb896390c797673d4a100d7d9abd055a63fea21cef26e896a0cb424a64de661e99abb8cd80347643720d5c529dabe92af619dcaa7ff8610f4b3c1782483

data/CHANGELOG.md

@@ -1,3 +1,364 @@
+## Rails 5.2.8.1 (July 12, 2022) ##
+
+*   Change ActiveRecord::Coders::YAMLColumn default to safe_load
+
+    This adds two new configuration options The configuration options are as
+    follows:
+    
+    * `config.active_storage.use_yaml_unsafe_load`
+    
+    When set to true, this configuration option tells Rails to use the old
+    "unsafe" YAML loading strategy, maintaining the existing behavior but leaving
+    the possible escalation vulnerability in place.  Setting this option to true
+    is *not* recommended, but can aid in upgrading.
+    
+    * `config.active_record.yaml_column_permitted_classes`
+    
+    The "safe YAML" loading method does not allow all classes to be deserialized
+    by default.  This option allows you to specify classes deemed "safe" in your
+    application.  For example, if your application uses Symbol and Time in
+    serialized data, you can add Symbol and Time to the allowed list as follows:
+    
+    ```
+    config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
+    ```
+
+    [CVE-2022-32224]
+
+
+## Rails 5.2.8 (May 09, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.7.1 (April 26, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.7 (March 10, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.6.3 (March 08, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.6.2 (February 11, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.6.1 (February 11, 2022) ##
+
+*   No changes.
+
+
+## Rails 5.2.6 (May 05, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.5 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.6 (May 05, 2021) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.5 (February 10, 2021) ##
+
+*   Fix possible DoS vector in PostgreSQL money type
+
+    Carefully crafted input can cause a DoS via the regular expressions used
+    for validating the money format in the PostgreSQL adapter.  This patch
+    fixes the regexp.
+
+    Thanks to @dee-see from Hackerone for this patch!
+
+    [CVE-2021-22880]
+
+    *Aaron Patterson*
+
+
+## Rails 5.2.4.4 (September 09, 2020) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.3 (May 18, 2020) ##
+
+*   No changes.
+
+## Rails 5.2.4.2 (March 19, 2020) ##
+
+*   No changes.
+
+
+## Rails 5.2.4.1 (December 18, 2019) ##
+
+*   No changes.
+
+
+## Rails 5.2.4 (November 27, 2019) ##
+
+*   Fix circular `autosave: true` causes invalid records to be saved.
+
+    Prior to the fix, when there was a circular series of `autosave: true`
+    associations, the callback for a `has_many` association was run while
+    another instance of the same callback on the same association hadn't
+    finished running. When control returned to the first instance of the
+    callback, the instance variable had changed, and subsequent associated
+    records weren't saved correctly. Specifically, the ID field for the
+    `belongs_to` corresponding to the `has_many` was `nil`.
+
+    Fixes #28080.
+
+    *Larry Reid*
+
+*   PostgreSQL: Fix GROUP BY with ORDER BY virtual count attribute.
+
+    Fixes #36022.
+
+    *Ryuta Kamizono*
+
+*   Fix sqlite3 collation parsing when using decimal columns.
+
+    *Martin R. Schuster*
+
+*   Make ActiveRecord `ConnectionPool.connections` method thread-safe.
+
+    Fixes #36465.
+
+    *Jeff Doering*
+
+*   Assign all attributes before calling `build` to ensure the child record is visible in
+    `before_add` and `after_add` callbacks for `has_many :through` associations.
+
+    Fixes #33249.
+
+    *Ryan H. Kerr*
+
+
+## Rails 5.2.3 (March 27, 2019) ##
+
+*   Fix different `count` calculation when using `size` with manual `select` with DISTINCT.
+
+    Fixes #35214.
+
+    *Juani Villarejo*
+
+*   Fix prepared statements caching to be enabled even when query caching is enabled.
+
+    *Ryuta Kamizono*
+
+*   Don't allow `where` with invalid value matches to nil values.
+
+    Fixes #33624.
+
+    *Ryuta Kamizono*
+
+*   Restore an ability that class level `update` without giving ids.
+
+    Fixes #34743.
+
+    *Ryuta Kamizono*
+
+*   Fix join table column quoting with SQLite.
+
+    *Gannon McGibbon*
+
+*   Ensure that `delete_all` on collection proxy returns affected count.
+
+    *Ryuta Kamizono*
+
+*   Reset scope after delete on collection association to clear stale offsets of removed records.
+
+    *Gannon McGibbon*
+
+
+## Rails 5.2.2.1 (March 11, 2019) ##
+
+*   No changes.
+
+
+## Rails 5.2.2 (December 04, 2018) ##
+
+*   Do not ignore the scoping with query methods in the scope block.
+
+    *Ryuta Kamizono*
+
+*   Allow aliased attributes to be used in `#update_columns` and `#update`.
+
+    *Gannon McGibbon*
+
+*   Allow spaces in postgres table names.
+
+    Fixes issue where "user post" is misinterpreted as "\"user\".\"post\"" when quoting table names with the postgres
+    adapter.
+
+    *Gannon McGibbon*
+
+*   Cached columns_hash fields should be excluded from ResultSet#column_types
+
+    PR #34528 addresses the inconsistent behaviour when attribute is defined for an ignored column. The following test
+    was passing for SQLite and MySQL, but failed for PostgreSQL:
+
+    ```ruby
+    class DeveloperName < ActiveRecord::Type::String
+      def deserialize(value)
+        "Developer: #{value}"
+      end
+    end
+
+    class AttributedDeveloper < ActiveRecord::Base
+      self.table_name = "developers"
+
+      attribute :name, DeveloperName.new
+
+      self.ignored_columns += ["name"]
+    end
+
+    developer = AttributedDeveloper.create
+    developer.update_column :name, "name"
+
+    loaded_developer = AttributedDeveloper.where(id: developer.id).select("*").first
+    puts loaded_developer.name # should be "Developer: name" but it's just "name"
+    ```
+
+    *Dmitry Tsepelev*
+
+*   Values of enum are frozen, raising an error when attempting to modify them.
+
+    *Emmanuel Byrd*
+
+*   `update_columns` now correctly raises `ActiveModel::MissingAttributeError`
+    if the attribute does not exist.
+
+    *Sean Griffin*
+
+*   Do not use prepared statement in queries that have a large number of binds.
+
+    *Ryuta Kamizono*
+
+*   Fix query cache to load before first request.
+
+    *Eileen M. Uchitelle*
+
+*   Fix collection cache key with limit and custom select to avoid ambiguous timestamp column error.
+
+    Fixes #33056.
+
+    *Federico Martinez*
+
+*   Fix duplicated record creation when using nested attributes with `create_with`.
+
+    *Darwin Wu*
+
+*   Fix regression setting children record in parent `before_save` callback.
+
+    *Guo Xiang Tan*
+
+*   Prevent leaking of user's DB credentials on `rails db:create` failure.
+
+    *bogdanvlviv*
+
+*   Clear mutation tracker before continuing the around callbacks.
+
+    *Yuya Tanaka*
+
+*   Prevent deadlocks when waiting for connection from pool.
+
+    *Brent Wheeldon*
+
+*   Avoid extra scoping when using `Relation#update` that was causing this method to change the current scope.
+
+    *Ryuta Kamizono*
+
+*   Fix numericality validator not to be affected by custom getter.
+
+    *Ryuta Kamizono*
+
+*   Fix bulk change table ignores comment option on PostgreSQL.
+
+    *Yoshiyuki Kinjo*
+
+
+## Rails 5.2.1.1 (November 27, 2018) ##
+
+*   No changes.
+
+
+## Rails 5.2.1 (August 07, 2018) ##
+
+*   PostgreSQL: Support new relkind for partitioned tables.
+
+    Fixes #33008.
+
+    *Yannick Schutz*
+
+*   Rollback parent transaction when children fails to update.
+
+    *Guillaume Malette*
+
+*   Fix default value for MySQL time types with specified precision.
+
+    *Nikolay Kondratyev*
+
+*   Fix `touch` option to behave consistently with `Persistence#touch` method.
+
+    *Ryuta Kamizono*
+
+*   Fix `save` in `after_create_commit` won't invoke extra `after_create_commit`.
+
+    Fixes #32831.
+
+    *Ryuta Kamizono*
+
+*   Fix logic on disabling commit callbacks so they are not called unexpectedly when errors occur.
+
+    *Brian Durand*
+
+*   Fix parent record should not get saved with duplicate children records.
+
+    Fixes #32940.
+
+    *Santosh Wadghule*
+
+*   Fix that association's after_touch is not called with counter cache.
+
+    Fixes #31559.
+
+    *Ryuta Kamizono*
+
+*   `becomes` should clear the mutation tracker which is created in `after_initialize`.
+
+    Fixes #32867.
+
+    *Ryuta Kamizono*
+
+*   Allow a belonging to parent object to be created from a new record.
+
+    *Jolyon Pawlyn*
+
+*   Fix that building record with assigning multiple has_one associations
+    wrongly persists through record.
+
+    Fixes #32511.
+
+    *Sam DeCesare*
+
+*   Fix relation merging when one of the relations is going to skip the
+    query cache.
+
+    *James Williams*
+
+
 ## Rails 5.2.0 (April 09, 2018) ##
 
 *   MySQL: Support mysql2 0.5.x.

data/lib/active_record/association_relation.rb

@@ -31,9 +31,9 @@ module ActiveRecord
     private
 
       def exec_queries
-        super do |r|
-          @association.set_inverse_instance r
-          yield r if block_given?
+        super do |record|
+          @association.set_inverse_instance_from_queries(record)
+          yield record if block_given?
         end
       end
   end

data/lib/active_record/associations/alias_tracker.rb

@@ -33,7 +33,7 @@ module ActiveRecord
           elsif join.is_a?(Arel::Nodes::Join)
             join.left.name == name ? 1 : 0
           elsif join.is_a?(Hash)
-            join.fetch(name, 0)
+            join[name]
           else
             raise ArgumentError, "joins list should be initialized by list of Arel::Nodes::Join"
           end

data/lib/active_record/associations/association.rb

@@ -19,7 +19,6 @@ module ActiveRecord
     #         HasManyThroughAssociation + ThroughAssociation
     class Association #:nodoc:
       attr_reader :owner, :target, :reflection
-      attr_accessor :inversed
 
       delegate :options, to: :reflection
 
@@ -67,7 +66,7 @@ module ActiveRecord
       #
       # Note that if the target has not been loaded, it is not considered stale.
       def stale_target?
-        !inversed && loaded? && @stale_state != stale_state
+        !@inversed && loaded? && @stale_state != stale_state
       end
 
       # Sets the target of this association to <tt>\target</tt>, and the \loaded flag to +true+.
@@ -98,23 +97,32 @@ module ActiveRecord
 
       # Set the inverse association, if possible
       def set_inverse_instance(record)
-        if invertible_for?(record)
-          inverse = record.association(inverse_reflection_for(record).name)
-          inverse.target = owner
-          inverse.inversed = true
+        if inverse = inverse_association_for(record)
+          inverse.inversed_from(owner)
+        end
+        record
+      end
+
+      def set_inverse_instance_from_queries(record)
+        if inverse = inverse_association_for(record)
+          inverse.inversed_from_queries(owner)
         end
         record
       end
 
       # Remove the inverse association, if possible
       def remove_inverse_instance(record)
-        if invertible_for?(record)
-          inverse = record.association(inverse_reflection_for(record).name)
-          inverse.target = nil
-          inverse.inversed = false
+        if inverse = inverse_association_for(record)
+          inverse.inversed_from(nil)
         end
       end
 
+      def inversed_from(record)
+        self.target = record
+        @inversed = !!record
+      end
+      alias :inversed_from_queries :inversed_from
+
       # Returns the class of the target. belongs_to polymorphic overrides this to look at the
       # polymorphic_type field on the owner.
       def klass
@@ -240,6 +248,12 @@ module ActiveRecord
           end
         end
 
+        def inverse_association_for(record)
+          if invertible_for?(record)
+            record.association(inverse_reflection_for(record).name)
+          end
+        end
+
         # Can be redefined by subclasses, notably polymorphic belongs_to
         # The record parameter is necessary to support polymorphic inverses as we must check for
         # the association in the specific class of the record.
@@ -269,6 +283,7 @@ module ActiveRecord
         def build_record(attributes)
           reflection.build_association(attributes) do |record|
             initialize_attributes(record, attributes)
+            yield(record) if block_given?
           end
         end
 

data/lib/active_record/associations/belongs_to_association.rb

@@ -26,10 +26,12 @@ module ActiveRecord
           decrement_counters
         end
 
+        replace_keys(record)
+
         self.target = record
       end
 
-      def target=(record)
+      def inversed_from(record)
         replace_keys(record)
         super
       end
@@ -55,6 +57,10 @@ module ActiveRecord
         update_counters(1)
       end
 
+      def target_changed?
+        owner.saved_change_to_attribute?(reflection.foreign_key)
+      end
+
       private
 
         def update_counters(by)
@@ -78,19 +84,22 @@ module ActiveRecord
         def update_counters_on_replace(record)
           if require_counter_update? && different_target?(record)
             owner.instance_variable_set :@_after_replace_counter_called, true
-            record.increment!(reflection.counter_cache_column)
+            record.increment!(reflection.counter_cache_column, touch: reflection.options[:touch])
             decrement_counters
           end
         end
 
         # Checks whether record is different to the current target, without loading it
         def different_target?(record)
-          record.id != owner._read_attribute(reflection.foreign_key)
+          record._read_attribute(primary_key(record)) != owner._read_attribute(reflection.foreign_key)
         end
 
         def replace_keys(record)
-          owner[reflection.foreign_key] = record ?
-            record._read_attribute(reflection.association_primary_key(record.class)) : nil
+          owner[reflection.foreign_key] = record ? record._read_attribute(primary_key(record)) : nil
+        end
+
+        def primary_key(record)
+          reflection.association_primary_key(record.class)
         end
 
         def foreign_key_present?

data/lib/active_record/associations/belongs_to_polymorphic_association.rb

@@ -9,8 +9,11 @@ module ActiveRecord
         type.presence && type.constantize
       end
 
-      private
+      def target_changed?
+        super || owner.saved_change_to_attribute?(reflection.foreign_type)
+      end
 
+      private
         def replace_keys(record)
           super
           owner[reflection.foreign_type] = record ? record.class.polymorphic_name : nil

data/lib/active_record/associations/builder/belongs_to.rb

@@ -36,7 +36,7 @@ module ActiveRecord::Associations::Builder # :nodoc:
 
           if (@_after_replace_counter_called ||= false)
             @_after_replace_counter_called = false
-          elsif saved_change_to_attribute?(foreign_key) && !new_record?
+          elsif association(reflection.name).target_changed?
             if reflection.polymorphic?
               model     = attribute_in_database(reflection.foreign_type).try(:constantize)
               model_was = attribute_before_last_save(reflection.foreign_type).try(:constantize)
@@ -49,14 +49,22 @@ module ActiveRecord::Associations::Builder # :nodoc:
             foreign_key     = attribute_in_database foreign_key
 
             if foreign_key && model.respond_to?(:increment_counter)
+              foreign_key = counter_cache_target(reflection, model, foreign_key)
               model.increment_counter(cache_column, foreign_key)
             end
 
             if foreign_key_was && model_was.respond_to?(:decrement_counter)
+              foreign_key_was = counter_cache_target(reflection, model_was, foreign_key_was)
               model_was.decrement_counter(cache_column, foreign_key_was)
             end
           end
         end
+
+        private
+          def counter_cache_target(reflection, model, foreign_key)
+            primary_key = reflection.association_primary_key(model)
+            model.unscoped.where!(primary_key => foreign_key)
+          end
       end
     end
 
@@ -84,7 +92,8 @@ module ActiveRecord::Associations::Builder # :nodoc:
         else
           klass = association.klass
         end
-        old_record = klass.find_by(klass.primary_key => old_foreign_id)
+        primary_key = reflection.association_primary_key(klass)
+        old_record = klass.find_by(primary_key => old_foreign_id)
 
         if old_record
           if touch != true

data/lib/active_record/associations/builder/collection_association.rb

@@ -20,10 +20,10 @@ module ActiveRecord::Associations::Builder # :nodoc:
       }
     end
 
-    def self.define_extensions(model, name)
+    def self.define_extensions(model, name, &block)
       if block_given?
         extension_module_name = "#{model.name.demodulize}#{name.to_s.camelize}AssociationExtension"
-        extension = Module.new(&Proc.new)
+        extension = Module.new(&block)
         model.parent.const_set(extension_module_name, extension)
       end
     end

data/lib/active_record/associations/collection_association.rb

@@ -45,6 +45,8 @@ module ActiveRecord
       def ids_reader
         if loaded?
           target.pluck(reflection.association_primary_key)
+        elsif !target.empty?
+          load_target.pluck(reflection.association_primary_key)
         else
           @association_ids ||= scope.pluck(reflection.association_primary_key)
         end
@@ -103,15 +105,12 @@ module ActiveRecord
         if attributes.is_a?(Array)
           attributes.collect { |attr| build(attr, &block) }
         else
-          add_to_target(build_record(attributes)) do |record|
-            yield(record) if block_given?
-          end
+          add_to_target(build_record(attributes, &block))
         end
       end
 
-      # Add +records+ to this association. Returns +self+ so method calls may
-      # be chained. Since << flattens its argument list and inserts each record,
-      # +push+ and +concat+ behave identically.
+      # Add +records+ to this association. Since +<<+ flattens its argument list
+      # and inserts each record, +push+ and +concat+ behave identically.
       def concat(*records)
         records = records.flatten
         if owner.new_record?
@@ -356,15 +355,17 @@ module ActiveRecord
           if attributes.is_a?(Array)
             attributes.collect { |attr| _create_record(attr, raise, &block) }
           else
+            record = build_record(attributes, &block)
             transaction do
-              add_to_target(build_record(attributes)) do |record|
-                yield(record) if block_given?
-                insert_record(record, true, raise) {
+              result = nil
+              add_to_target(record) do
+                result = insert_record(record, true, raise) {
                   @_was_loaded = loaded?
-                  @association_ids = nil
                 }
               end
+              raise ActiveRecord::Rollback unless result
             end
+            record
           end
         end
 
@@ -396,6 +397,7 @@ module ActiveRecord
 
           delete_records(existing_records, method) if existing_records.any?
           records.each { |record| target.delete(record) }
+          @association_ids = nil
 
           records.each { |record| callback(:after_remove, record) }
         end
@@ -408,9 +410,9 @@ module ActiveRecord
         end
 
         def replace_records(new_target, original_target)
-          delete(target - new_target)
+          delete(difference(target, new_target))
 
-          unless concat(new_target - target)
+          unless concat(difference(new_target, target))
             @target = original_target
             raise RecordNotSaved, "Failed to replace #{reflection.name} because one or more of the " \
                                   "new records could not be saved."
@@ -420,7 +422,7 @@ module ActiveRecord
         end
 
         def replace_common_records_in_memory(new_target, original_target)
-          common_records = new_target & original_target
+          common_records = intersection(new_target, original_target)
           common_records.each do |record|
             skip_callbacks = true
             replace_on_target(record, @target.index(record), skip_callbacks)
@@ -436,13 +438,14 @@ module ActiveRecord
               unless owner.new_record?
                 result &&= insert_record(record, true, raise) {
                   @_was_loaded = loaded?
-                  @association_ids = nil
                 }
               end
             end
           end
 
-          result && records
+          raise ActiveRecord::Rollback unless result
+
+          records
         end
 
         def replace_on_target(record, index, skip_callbacks)
@@ -457,6 +460,7 @@ module ActiveRecord
           if index
             target[index] = record
           elsif @_was_loaded || !loaded?
+            @association_ids = nil
             target << record
           end