activerecord 6.1.6 → 7.1.2

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -5,42 +5,69 @@ require "active_support/multibyte/chars"
 
 module ActiveRecord
   module ConnectionAdapters # :nodoc:
+    # = Active Record Connection Adapters \Quoting
     module Quoting
       # Quotes the column value to help prevent
       # {SQL injection attacks}[https://en.wikipedia.org/wiki/SQL_injection].
       def quote(value)
-        if value.is_a?(Base)
-          ActiveSupport::Deprecation.warn(<<~MSG)
-            Passing an Active Record object to `quote` directly is deprecated
-            and will be no longer quoted as id value in Rails 7.0.
-          MSG
-          value = value.id_for_database
+        case value
+        when String, Symbol, ActiveSupport::Multibyte::Chars
+          "'#{quote_string(value.to_s)}'"
+        when true       then quoted_true
+        when false      then quoted_false
+        when nil        then "NULL"
+        # BigDecimals need to be put in a non-normalized form and quoted.
+        when BigDecimal then value.to_s("F")
+        when Numeric then value.to_s
+        when Type::Binary::Data then quoted_binary(value)
+        when Type::Time::Value then "'#{quoted_time(value)}'"
+        when Date, Time then "'#{quoted_date(value)}'"
+        when Class      then "'#{value}'"
+        when ActiveSupport::Duration
+          warn_quote_duration_deprecated
+          value.to_s
+        else raise TypeError, "can't quote #{value.class.name}"
         end
-
-        _quote(value)
       end
 
       # Cast a +value+ to a type that the database understands. For example,
       # SQLite does not understand dates, so this method will convert a Date
       # to a String.
-      def type_cast(value, column = nil)
-        if value.is_a?(Base)
-          ActiveSupport::Deprecation.warn(<<~MSG)
-            Passing an Active Record object to `type_cast` directly is deprecated
-            and will be no longer type casted as id value in Rails 7.0.
-          MSG
-          value = value.id_for_database
+      def type_cast(value)
+        case value
+        when Symbol, ActiveSupport::Multibyte::Chars, Type::Binary::Data
+          value.to_s
+        when true       then unquoted_true
+        when false      then unquoted_false
+        # BigDecimals need to be put in a non-normalized form and quoted.
+        when BigDecimal then value.to_s("F")
+        when nil, Numeric, String then value
+        when Type::Time::Value then quoted_time(value)
+        when Date, Time then quoted_date(value)
+        else raise TypeError, "can't cast #{value.class.name}"
         end
+      end
 
-        if column
-          ActiveSupport::Deprecation.warn(<<~MSG)
-            Passing a column to `type_cast` is deprecated and will be removed in Rails 7.0.
-          MSG
-          type = lookup_cast_type_from_column(column)
-          value = type.serialize(value)
-        end
+      # Quote a value to be used as a bound parameter of unknown type. For example,
+      # MySQL might perform dangerous castings when comparing a string to a number,
+      # so this method will cast numbers to string.
+      #
+      # Deprecated: Consider `Arel.sql("... ? ...", value)` or
+      # +sanitize_sql+ instead.
+      def quote_bound_value(value)
+        ActiveRecord.deprecator.warn(<<~MSG.squish)
+          #quote_bound_value is deprecated and will be removed in Rails 7.2.
+          Consider Arel.sql(".. ? ..", value) or #sanitize_sql instead.
+        MSG
 
-        _type_cast(value)
+        quote(cast_bound_value(value))
+      end
+
+      # Cast a value to be used as a bound parameter of unknown type. For example,
+      # MySQL might perform dangerous castings when comparing a string to a number,
+      # so this method will cast numbers to string.
+      def cast_bound_value(value) # :nodoc:
+        value
       end
 
       # If you are having to call this function, you are likely doing something
@@ -59,7 +86,7 @@ module ActiveRecord
       # Quotes a string, escaping any ' (single quote) and \ (backslash)
       # characters.
       def quote_string(s)
-        s.gsub('\\', '\&\&').gsub("'", "''") # ' (for ruby-mode)
+        s.gsub("\\", '\&\&').gsub("'", "''") # ' (for ruby-mode)
       end
 
       # Quotes the column name. Defaults to no quoting.
@@ -75,7 +102,7 @@ module ActiveRecord
       # Override to return the quoted table name for assignment. Defaults to
       # table quoting.
       #
-      # This works for mysql2 where table.column can be used to
+      # This works for MySQL where table.column can be used to
       # resolve ambiguity.
       #
       # We override this in the sqlite3 and postgresql adapters to use only
@@ -113,14 +140,14 @@ module ActiveRecord
       # if the value is a Time responding to usec.
       def quoted_date(value)
         if value.acts_like?(:time)
-          if ActiveRecord::Base.default_timezone == :utc
-            value = value.getutc if value.respond_to?(:getutc) && !value.utc?
+          if default_timezone == :utc
+            value = value.getutc if !value.utc?
           else
-            value = value.getlocal if value.respond_to?(:getlocal)
+            value = value.getlocal
           end
         end
 
-        result = value.to_s(:db)
+        result = value.to_fs(:db)
         if value.respond_to?(:usec) && value.usec > 0
           result << "." << sprintf("%06d", value.usec)
         else
@@ -138,7 +165,16 @@ module ActiveRecord
       end
 
       def sanitize_as_sql_comment(value) # :nodoc:
-        value.to_s.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+        # Sanitize a string to appear within a SQL comment
+        # For compatibility, this also surrounding "/*+", "/*", and "*/"
+        # charcacters, possibly with single surrounding space.
+        # Then follows that by replacing any internal "*/" or "/ *" with
+        # "* /" or "/ *"
+        comment = value.to_s.dup
+        comment.gsub!(%r{\A\s*/\*\+?\s?|\s?\*/\s*\Z}, "")
+        comment.gsub!("*/", "* /")
+        comment.gsub!("/*", "/ *")
+        comment
       end
 
       def column_name_matcher # :nodoc:
@@ -159,7 +195,7 @@ module ActiveRecord
         (
           (?:
             # table_name.column_name | function(one or no argument)
-            ((?:\w+\.)?\w+) | \w+\((?:|\g<2>)\)
+            ((?:\w+\.)?\w+ | \w+\((?:|\g<2>)\))
           )
           (?:(?:\s+AS)?\s+\w+)?
         )
@@ -183,7 +219,7 @@ module ActiveRecord
         (
           (?:
             # table_name.column_name | function(one or no argument)
-            ((?:\w+\.)?\w+) | \w+\((?:|\g<2>)\)
+            ((?:\w+\.)?\w+ | \w+\((?:|\g<2>)\))
           )
           (?:\s+ASC|\s+DESC)?
           (?:\s+NULLS\s+(?:FIRST|LAST))?
@@ -196,16 +232,11 @@ module ActiveRecord
 
       private
         def type_casted_binds(binds)
-          case binds.first
-          when Array
-            binds.map { |column, value| type_cast(value, column) }
-          else
-            binds.map do |value|
-              if ActiveModel::Attribute === value
-                type_cast(value.value_for_database)
-              else
-                type_cast(value)
-              end
+          binds.map do |value|
+            if ActiveModel::Attribute === value
+              type_cast(value.value_for_database)
+            else
+              type_cast(value)
             end
           end
         end
@@ -214,37 +245,20 @@ module ActiveRecord
           type_map.lookup(sql_type)
         end
 
-        def _quote(value)
-          case value
-          when String, Symbol, ActiveSupport::Multibyte::Chars
-            "'#{quote_string(value.to_s)}'"
-          when true       then quoted_true
-          when false      then quoted_false
-          when nil        then "NULL"
-          # BigDecimals need to be put in a non-normalized form and quoted.
-          when BigDecimal then value.to_s("F")
-          when Numeric, ActiveSupport::Duration then value.to_s
-          when Type::Binary::Data then quoted_binary(value)
-          when Type::Time::Value then "'#{quoted_time(value)}'"
-          when Date, Time then "'#{quoted_date(value)}'"
-          when Class      then "'#{value}'"
-          else raise TypeError, "can't quote #{value.class.name}"
-          end
-        end
-
-        def _type_cast(value)
-          case value
-          when Symbol, ActiveSupport::Multibyte::Chars, Type::Binary::Data
-            value.to_s
-          when true       then unquoted_true
-          when false      then unquoted_false
-          # BigDecimals need to be put in a non-normalized form and quoted.
-          when BigDecimal then value.to_s("F")
-          when nil, Numeric, String then value
-          when Type::Time::Value then quoted_time(value)
-          when Date, Time then quoted_date(value)
-          else raise TypeError, "can't cast #{value.class.name}"
-          end
+        def warn_quote_duration_deprecated
+          ActiveRecord.deprecator.warn(<<~MSG)
+            Using ActiveSupport::Duration as an interpolated bind parameter in a SQL
+            string template is deprecated. To avoid this warning, you should explicitly
+            convert the duration to a more specific database type. For example, if you
+            want to use a duration as an integer number of seconds:
+            ```
+            Record.where("duration = ?", 1.hour.to_i)
+            ```
+            If you want to use a duration as an ISO 8601 string:
+            ```
+            Record.where("duration = ?", 1.hour.iso8601)
+            ```
+          MSG
         end
     end
   end

data/lib/active_record/connection_adapters/abstract/savepoints.rb

@@ -2,21 +2,22 @@
 
 module ActiveRecord
   module ConnectionAdapters
+    # = Active Record Connection Adapters \Savepoints
     module Savepoints
       def current_savepoint_name
         current_transaction.savepoint_name
       end
 
       def create_savepoint(name = current_savepoint_name)
-        execute("SAVEPOINT #{name}", "TRANSACTION")
+        internal_execute("SAVEPOINT #{name}", "TRANSACTION")
       end
 
       def exec_rollback_to_savepoint(name = current_savepoint_name)
-        execute("ROLLBACK TO SAVEPOINT #{name}", "TRANSACTION")
+        internal_execute("ROLLBACK TO SAVEPOINT #{name}", "TRANSACTION")
       end
 
       def release_savepoint(name = current_savepoint_name)
-        execute("RELEASE SAVEPOINT #{name}", "TRANSACTION")
+        internal_execute("RELEASE SAVEPOINT #{name}", "TRANSACTION")
       end
     end
   end

data/lib/active_record/connection_adapters/abstract/schema_creation.rb

@@ -14,8 +14,10 @@ module ActiveRecord
       end
 
       delegate :quote_column_name, :quote_table_name, :quote_default_expression, :type_to_sql,
-        :options_include_default?, :supports_indexes_in_create?, :supports_foreign_keys?, :foreign_key_options,
-        :quoted_columns_for_index, :supports_partial_index?, :supports_check_constraints?, :check_constraint_options,
+        :options_include_default?, :supports_indexes_in_create?, :use_foreign_keys?,
+        :quoted_columns_for_index, :supports_partial_index?, :supports_check_constraints?,
+        :supports_index_include?, :supports_exclusion_constraints?, :supports_unique_constraints?,
+        :supports_nulls_not_distinct?,
         to: :@conn, private: true
 
       private
@@ -51,12 +53,20 @@ module ActiveRecord
             statements.concat(o.indexes.map { |column_name, options| index_in_create(o.name, column_name, options) })
           end
 
-          if supports_foreign_keys?
-            statements.concat(o.foreign_keys.map { |to_table, options| foreign_key_in_create(o.name, to_table, options) })
+          if use_foreign_keys?
+            statements.concat(o.foreign_keys.map { |fk| accept fk })
           end
 
           if supports_check_constraints?
-            statements.concat(o.check_constraints.map { |expression, options| check_constraint_in_create(o.name, expression, options) })
+            statements.concat(o.check_constraints.map { |chk| accept chk })
+          end
+
+          if supports_exclusion_constraints?
+            statements.concat(o.exclusion_constraints.map { |exc| accept exc })
+          end
+
+          if supports_unique_constraints?
+            statements.concat(o.unique_constraints.map { |exc| accept exc })
           end
 
           create_sql << "(#{statements.join(', ')})" if statements.present?
@@ -70,10 +80,12 @@ module ActiveRecord
         end
 
         def visit_ForeignKeyDefinition(o)
+          quoted_columns = Array(o.column).map { |c| quote_column_name(c) }
+          quoted_primary_keys = Array(o.primary_key).map { |c| quote_column_name(c) }
           sql = +<<~SQL
             CONSTRAINT #{quote_column_name(o.name)}
-            FOREIGN KEY (#{quote_column_name(o.column)})
-              REFERENCES #{quote_table_name(o.to_table)} (#{quote_column_name(o.primary_key)})
+            FOREIGN KEY (#{quoted_columns.join(", ")})
+              REFERENCES #{quote_table_name(o.to_table)} (#{quoted_primary_keys.join(", ")})
           SQL
           sql << " #{action_sql('DELETE', o.on_delete)}" if o.on_delete
           sql << " #{action_sql('UPDATE', o.on_update)}" if o.on_update
@@ -100,6 +112,8 @@ module ActiveRecord
           sql << "#{quote_column_name(index.name)} ON #{quote_table_name(index.table)}"
           sql << "USING #{index.using}" if supports_index_using? && index.using
           sql << "(#{quoted_columns(index)})"
+          sql << "INCLUDE (#{quoted_include_columns(index.include)})" if supports_index_include? && index.include
+          sql << "NULLS NOT DISTINCT" if supports_nulls_not_distinct? && index.nulls_not_distinct
           sql << "WHERE #{index.where}" if supports_partial_index? && index.where
 
           sql.join(" ")
@@ -159,19 +173,6 @@ module ActiveRecord
           " TEMPORARY" if o.temporary
         end
 
-        def foreign_key_in_create(from_table, to_table, options)
-          prefix = ActiveRecord::Base.table_name_prefix
-          suffix = ActiveRecord::Base.table_name_suffix
-          to_table = "#{prefix}#{to_table}#{suffix}"
-          options = foreign_key_options(from_table, to_table, options)
-          accept ForeignKeyDefinition.new(from_table, to_table, options)
-        end
-
-        def check_constraint_in_create(table_name, expression, options)
-          options = check_constraint_options(table_name, expression, options)
-          accept CheckConstraintDefinition.new(table_name, expression, options)
-        end
-
         def action_sql(action, dependency)
           case dependency
           when :nullify then "ON #{action} SET NULL"