activerecord 6.1.7 → 6.1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f11907365b78163229d5724a47f9a99b84ad5d8adbb8092b05d7fcc657b3068e
-  data.tar.gz: e495d26d1c679db2ab9a91e81112ae6b22d3466702601e645bfc43067166efa2
+  metadata.gz: '09a11c6e190ba1511552e4b5a9fe588f8249df1cb20637e6968df53d96664892'
+  data.tar.gz: 0fef11bd4289d949121ff585d462ce3e2bac9d76fe1f0780b49ac91737abbd81
 SHA512:
-  metadata.gz: 688b39dd7ca026c860efd8311df6ed968abd37ed4655fd04816abd3aa03f625fe63026f66cbac20d3db3c60c449dd4fd0621e6705c8f22f5b68025f9fa83eee7
-  data.tar.gz: 58fdf458ec41d07a4eff8aee4f79b636d2347460f28a2bbc99fc475a96bb3ae0c4961f558603f237e3e838f3d69ba320d9583b8c5c78bfe470585561ff16f48c
+  metadata.gz: 332d9b4ee85a42d09271048a13230a840b52e130c707cd58ded59f15eaa8a39281a6f1d19ab2a3f34c1781c34137eb844dae900f43fe97b28b3667fa299cf2dc
+  data.tar.gz: 280d7d523395a9bff3e17bdc82b366fa5bf9149482866c482de8917ba711bdef0f7fac53645e65d183ba26114ff81a3b844e373bdc9a5432fc3ef0238035a343

data/CHANGELOG.md

@@ -1,3 +1,38 @@
+## Rails 6.1.7.2 (January 24, 2023) ##
+
+*   No changes.
+
+
+## Rails 6.1.7.1 (January 17, 2023) ##
+
+*   Make sanitize_as_sql_comment more strict
+
+    Though this method was likely never meant to take user input, it was
+    attempting sanitization. That sanitization could be bypassed with
+    carefully crafted input.
+
+    This commit makes the sanitization more robust by replacing any
+    occurrances of "/*" or "*/" with "/ *" or "* /". It also performs a
+    first pass to remove one surrounding comment to avoid compatibility
+    issues for users relying on the existing removal.
+
+    This also clarifies in the documentation of annotate that it should not
+    be provided user input.
+
+    [CVE-2023-22794]
+
+*   Added integer width check to PostgreSQL::Quoting
+
+    Given a value outside the range for a 64bit signed integer type
+    PostgreSQL will treat the column type as numeric. Comparing
+    integer values against numeric values can result in a slow
+    sequential scan.
+
+    This behavior is configurable via
+    ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.
+
+    [CVE-2022-44566]
+
 ## Rails 6.1.7 (September 09, 2022) ##
 
 *   Symbol is allowed by default for YAML columns

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -138,7 +138,16 @@ module ActiveRecord
       end
 
       def sanitize_as_sql_comment(value) # :nodoc:
-        value.to_s.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+        # Sanitize a string to appear within a SQL comment
+        # For compatibility, this also surrounding "/*+", "/*", and "*/"
+        # charcacters, possibly with single surrounding space.
+        # Then follows that by replacing any internal "*/" or "/ *" with
+        # "* /" or "/ *"
+        comment = value.to_s.dup
+        comment.gsub!(%r{\A\s*/\*\+?\s?|\s?\*/\s*\Z}, "")
+        comment.gsub!("*/", "* /")
+        comment.gsub!("/*", "/ *")
+        comment
       end
 
       def column_name_matcher # :nodoc:

data/lib/active_record/connection_adapters/postgresql/quoting.rb

@@ -4,6 +4,12 @@ module ActiveRecord
   module ConnectionAdapters
     module PostgreSQL
       module Quoting
+        class IntegerOutOf64BitRange < StandardError
+          def initialize(msg)
+            super(msg)
+          end
+        end
+
         # Escapes binary strings for bytea input to the database.
         def escape_bytea(value)
           @connection.escape_bytea(value) if value
@@ -120,7 +126,27 @@ module ActiveRecord
             super(query_value("SELECT #{quote(sql_type)}::regtype::oid", "SCHEMA").to_i)
           end
 
+          def check_int_in_range(value)
+            if value.to_int > 9223372036854775807 || value.to_int < -9223372036854775808
+              exception = <<~ERROR
+                Provided value outside of the range of a signed 64bit integer.
+
+                PostgreSQL will treat the column type in question as a numeric.
+                This may result in a slow sequential scan due to a comparison
+                being performed between an integer or bigint value and a numeric value.
+
+                To allow for this potentially unwanted behavior, set
+                ActiveRecord::Base.raise_int_wider_than_64bit to false.
+              ERROR
+              raise IntegerOutOf64BitRange.new exception
+            end
+          end
+
           def _quote(value)
+            if ActiveRecord::Base.raise_int_wider_than_64bit && value.is_a?(Integer)
+              check_int_in_range(value)
+            end
+
             case value
             when OID::Xml::Data
               "xml '#{quote_string(value.to_s)}'"

data/lib/active_record/core.rb

@@ -163,6 +163,13 @@ module ActiveRecord
       # to Psych safe_load in the YAML Coder
       mattr_accessor :yaml_column_permitted_classes, instance_writer: false, default: [Symbol]
 
+      ##
+      # :singleton-method:
+      # Application configurable boolean that denotes whether or not to raise
+      # an exception when the PostgreSQLAdapter is provided with an integer that is
+      # wider than signed 64bit representation
+      mattr_accessor :raise_int_wider_than_64bit, instance_writer: false, default: true
+
       self.filter_attributes = []
 
       def self.connection_handler

data/lib/active_record/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 6
     MINOR = 1
     TINY  = 7
-    PRE   = nil
+    PRE   = "2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_record/relation/query_methods.rb

@@ -1035,6 +1035,8 @@ module ActiveRecord
     #   # SELECT "users"."name" FROM "users" /* selecting */ /* user */ /* names */
     #
     # The SQL block comment delimiters, "/*" and "*/", will be added automatically.
+    #
+    # Some escaping is performed, however untrusted user input should not be used.
     def annotate(*args)
       check_if_method_has_arguments!(:annotate, args)
       spawn.annotate!(*args)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.1.7
+  version: 6.1.7.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-09 00:00:00.000000000 Z
+date: 2023-01-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7
+        version: 6.1.7.2
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -390,10 +390,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.7/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.7/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.2/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.7/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.2/activerecord
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options:
@@ -412,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.4.3
 signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).