activerecord 6.1.6.1 → 6.1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2093e13defc611f0ec1e62d7efd445bcd1c5b182d8aab24f3dd3625047ce2f9f
-  data.tar.gz: 8d3e9a6daab9d0026cc1826d1caf2f24fee239d05b63cbb0eac866b1daded767
+  metadata.gz: c9b76baff5a3e39a0efb5a3780007e80b4da0ab9518c2707d120d035dc8c77ec
+  data.tar.gz: b4bf736f8d49fe9f3f65c6c0a763b138fdbcafbc0ab808e2bb9bd16c9bca6620
 SHA512:
-  metadata.gz: 3e6be64f1492b2441290abac0af6cde31950acef133ccdd98202b2ab719dc48b0f969eda318b4712c508cde2f29b3a6c381c27c6e7467b4ee25ec97209717d7a
-  data.tar.gz: 924c8bcbbaa608deb02263437e76947737b041b39a86818585e3d087530f0d1e3fdc537fc10d1177fe6cf2413deaf47f655342435312a5d473a4789e7a35631f
+  metadata.gz: 8a3961a9e8a96f9333e08cce6f4e1b3747e6d58e60a60353a1ab0f5512423c5b64c6796bf782f98f3080e5558f26a9875d5bf0f3a4f2ecb36edbb86d4fe2abb1
+  data.tar.gz: 3cf8d6bde005afc71b62ebb545457896b899cf2f2a0d78512e3f1134fe0226e58579e3e3b80a19c3130ea8a5a53dfb98c5b3273ee0c38e28c34c4f474d672aa5

data/CHANGELOG.md

@@ -1,3 +1,52 @@
+## Rails 6.1.7.1 (January 17, 2023) ##
+
+*   Make sanitize_as_sql_comment more strict
+
+    Though this method was likely never meant to take user input, it was
+    attempting sanitization. That sanitization could be bypassed with
+    carefully crafted input.
+
+    This commit makes the sanitization more robust by replacing any
+    occurrances of "/*" or "*/" with "/ *" or "* /". It also performs a
+    first pass to remove one surrounding comment to avoid compatibility
+    issues for users relying on the existing removal.
+
+    This also clarifies in the documentation of annotate that it should not
+    be provided user input.
+
+    [CVE-2023-22794]
+
+*   Added integer width check to PostgreSQL::Quoting
+
+    Given a value outside the range for a 64bit signed integer type
+    PostgreSQL will treat the column type as numeric. Comparing
+    integer values against numeric values can result in a slow
+    sequential scan.
+
+    This behavior is configurable via
+    ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.
+
+    [CVE-2022-44566]
+
+## Rails 6.1.7 (September 09, 2022) ##
+
+*   Symbol is allowed by default for YAML columns
+
+    *Étienne Barrié*
+
+*   Fix `ActiveRecord::Store` to serialize as a regular Hash
+
+    Previously it would serialize as an `ActiveSupport::HashWithIndifferentAccess`
+    which is wasteful and cause problem with YAML safe_load.
+
+    *Jean Boussier*
+
+*   Fix PG.connect keyword arguments deprecation warning on ruby 2.7
+
+    Fixes #44307.
+
+    *Nikita Vasilevsky*
+
 ## Rails 6.1.6.1 (July 12, 2022) ##
 
 *   Change ActiveRecord::Coders::YAMLColumn default to safe_load
@@ -26,6 +75,11 @@
     [CVE-2022-32224]
 
 
+## Rails 6.1.6 (May 09, 2022) ##
+
+*   No changes.
+
+
 ## Rails 6.1.5.1 (April 26, 2022) ##
 
 *   No changes.

data/lib/active_record/coders/yaml_column.rb

@@ -45,14 +45,24 @@ module ActiveRecord
           raise ArgumentError, "Cannot serialize #{object_class}. Classes passed to `serialize` must have a 0 argument constructor."
         end
 
-        def yaml_load(payload)
-          if !ActiveRecord::Base.use_yaml_unsafe_load
-            YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
-          else
-            if YAML.respond_to?(:unsafe_load)
+        if YAML.respond_to?(:unsafe_load)
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
               YAML.unsafe_load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
             else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
+            end
+          end
+        else
+          def yaml_load(payload)
+            if ActiveRecord::Base.use_yaml_unsafe_load
               YAML.load(payload)
+            elsif YAML.method(:safe_load).parameters.include?([:key, :permitted_classes])
+              YAML.safe_load(payload, permitted_classes: ActiveRecord::Base.yaml_column_permitted_classes, aliases: true)
+            else
+              YAML.safe_load(payload, ActiveRecord::Base.yaml_column_permitted_classes, [], true)
             end
           end
         end

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -138,7 +138,16 @@ module ActiveRecord
       end
 
       def sanitize_as_sql_comment(value) # :nodoc:
-        value.to_s.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+        # Sanitize a string to appear within a SQL comment
+        # For compatibility, this also surrounding "/*+", "/*", and "*/"
+        # charcacters, possibly with single surrounding space.
+        # Then follows that by replacing any internal "*/" or "/ *" with
+        # "* /" or "/ *"
+        comment = value.to_s.dup
+        comment.gsub!(%r{\A\s*/\*\+?\s?|\s?\*/\s*\Z}, "")
+        comment.gsub!("*/", "* /")
+        comment.gsub!("/*", "/ *")
+        comment
       end
 
       def column_name_matcher # :nodoc:

data/lib/active_record/connection_adapters/postgresql/quoting.rb

@@ -4,6 +4,12 @@ module ActiveRecord
   module ConnectionAdapters
     module PostgreSQL
       module Quoting
+        class IntegerOutOf64BitRange < StandardError
+          def initialize(msg)
+            super(msg)
+          end
+        end
+
         # Escapes binary strings for bytea input to the database.
         def escape_bytea(value)
           @connection.escape_bytea(value) if value
@@ -120,7 +126,27 @@ module ActiveRecord
             super(query_value("SELECT #{quote(sql_type)}::regtype::oid", "SCHEMA").to_i)
           end
 
+          def check_int_in_range(value)
+            if value.to_int > 9223372036854775807 || value.to_int < -9223372036854775808
+              exception = <<~ERROR
+                Provided value outside of the range of a signed 64bit integer.
+
+                PostgreSQL will treat the column type in question as a numeric.
+                This may result in a slow sequential scan due to a comparison
+                being performed between an integer or bigint value and a numeric value.
+
+                To allow for this potentially unwanted behavior, set
+                ActiveRecord::Base.raise_int_wider_than_64bit to false.
+              ERROR
+              raise IntegerOutOf64BitRange.new exception
+            end
+          end
+
           def _quote(value)
+            if ActiveRecord::Base.raise_int_wider_than_64bit && value.is_a?(Integer)
+              check_int_in_range(value)
+            end
+
             case value
             when OID::Xml::Data
               "xml '#{quote_string(value.to_s)}'"

data/lib/active_record/connection_adapters/postgresql_adapter.rb

@@ -75,7 +75,7 @@ module ActiveRecord
 
       class << self
         def new_client(conn_params)
-          PG.connect(conn_params)
+          PG.connect(**conn_params)
         rescue ::PG::Error => error
           if conn_params && conn_params[:dbname] && error.message.include?(conn_params[:dbname])
             raise ActiveRecord::NoDatabaseError
@@ -247,7 +247,7 @@ module ActiveRecord
       def initialize(connection, logger, connection_parameters, config)
         super(connection, logger, config)
 
-        @connection_parameters = connection_parameters
+        @connection_parameters = connection_parameters || {}
 
         # @local_tz is initialized as nil to avoid warnings when connect tries to use it
         @local_tz = nil

data/lib/active_record/core.rb

@@ -161,7 +161,14 @@ module ActiveRecord
 
       # Application configurable array that provides additional permitted classes
       # to Psych safe_load in the YAML Coder
-      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: []
+      mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: [Symbol]
+
+      ##
+      # :singleton-method:
+      # Application configurable boolean that denotes whether or not to raise
+      # an exception when the PostgreSQLAdapter is provided with an integer that is
+      # wider than signed 64bit representation
+      mattr_accessor :raise_int_wider_than_64bit, instance_writer: false, default: true
 
       self.filter_attributes = []
 

data/lib/active_record/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveRecord
   module VERSION
     MAJOR = 6
     MINOR = 1
-    TINY  = 6
+    TINY  = 7
     PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/active_record/railtie.rb

@@ -279,23 +279,5 @@ To keep using the current cache store, you can turn off cache versioning entirel
         self.signed_id_verifier_secret ||= -> { Rails.application.key_generator.generate_key("active_record/signed_id") }
       end
     end
-
-    initializer "active_record.use_yaml_unsafe_load" do |app|
-      config.after_initialize do
-        unless app.config.active_record.use_yaml_unsafe_load.nil?
-          ActiveRecord::Base.use_yaml_unsafe_load =
-            app.config.active_record.use_yaml_unsafe_load
-        end
-      end
-    end
-
-    initializer "active_record.yaml_column_permitted_classes" do |app|
-      config.after_initialize do
-        unless app.config.active_record.yaml_column_permitted_classes.nil?
-          ActiveRecord::Base.yaml_column_permitted_classes =
-            app.config.active_record.yaml_column_permitted_classes
-        end
-      end
-    end
   end
 end

data/lib/active_record/relation/query_methods.rb

@@ -1035,6 +1035,8 @@ module ActiveRecord
     #   # SELECT "users"."name" FROM "users" /* selecting */ /* user */ /* names */
     #
     # The SQL block comment delimiters, "/*" and "*/", will be added automatically.
+    #
+    # Some escaping is performed, however untrusted user input should not be used.
     def annotate(*args)
       check_if_method_has_arguments!(:annotate, args)
       spawn.annotate!(*args)

data/lib/active_record/store.rb

@@ -268,7 +268,7 @@ module ActiveRecord
         end
 
         def dump(obj)
-          @coder.dump self.class.as_indifferent_hash(obj)
+          @coder.dump as_regular_hash(obj)
         end
 
         def load(yaml)
@@ -285,6 +285,11 @@ module ActiveRecord
             ActiveSupport::HashWithIndifferentAccess.new
           end
         end
+
+        private
+          def as_regular_hash(obj)
+            obj.respond_to?(:to_hash) ? obj.to_hash : {}
+          end
       end
   end
 end

data/lib/active_record/test_fixtures.rb

@@ -134,7 +134,7 @@ module ActiveRecord
         @connection_subscriber = ActiveSupport::Notifications.subscribe("!connection.active_record") do |_, _, _, _, payload|
           spec_name = payload[:spec_name] if payload.key?(:spec_name)
           shard = payload[:shard] if payload.key?(:shard)
-          setup_shared_connection_pool
+          setup_shared_connection_pool if ActiveRecord::Base.legacy_connection_handling
 
           if spec_name
             begin
@@ -143,10 +143,14 @@ module ActiveRecord
               connection = nil
             end
 
-            if connection && !@fixture_connections.include?(connection)
-              connection.begin_transaction joinable: false, _lazy: false
-              connection.pool.lock_thread = true if lock_threads
-              @fixture_connections << connection
+            if connection
+              setup_shared_connection_pool unless ActiveRecord::Base.legacy_connection_handling
+
+              if !@fixture_connections.include?(connection)
+                connection.begin_transaction joinable: false, _lazy: false
+                connection.pool.lock_thread = true if lock_threads
+                @fixture_connections << connection
+              end
             end
           end
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.1.6.1
+  version: 6.1.7.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-07-12 00:00:00.000000000 Z
+date: 2023-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.6.1
+        version: 6.1.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.6.1
+        version: 6.1.7.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.6.1
+        version: 6.1.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.6.1
+        version: 6.1.7.1
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -390,10 +390,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.6.1/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.6.1/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.1/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.6.1/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.1/activerecord
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options:
@@ -412,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.4.3
 signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).