activerecord 6.1.7 → 7.2.2

data/lib/active_record/result.rb

@@ -2,11 +2,13 @@
 
 module ActiveRecord
   ###
+  # = Active Record \Result
+  #
   # This class encapsulates a result returned from calling
   # {#exec_query}[rdoc-ref:ConnectionAdapters::DatabaseStatements#exec_query]
   # on any database connection adapter. For example:
   #
-  #   result = ActiveRecord::Base.connection.exec_query('SELECT id, title, body FROM posts')
+  #   result = ActiveRecord::Base.lease_connection.exec_query('SELECT id, title, body FROM posts')
   #   result # => #<ActiveRecord::Result:0xdeadbeef>
   #
   #   # Get the column names of the result:
@@ -36,11 +38,22 @@ module ActiveRecord
 
     attr_reader :columns, :rows, :column_types
 
-    def initialize(columns, rows, column_types = {})
-      @columns      = columns
+    def self.empty(async: false) # :nodoc:
+      if async
+        EMPTY_ASYNC
+      else
+        EMPTY
+      end
+    end
+
+    def initialize(columns, rows, column_types = nil)
+      # We freeze the strings to prevent them getting duped when
+      # used as keys in ActiveRecord::Base's @attributes hash
+      @columns      = columns.each(&:-@).freeze
       @rows         = rows
       @hash_rows    = nil
-      @column_types = column_types
+      @column_types = column_types || EMPTY_HASH
+      @column_indexes = nil
     end
 
     # Returns true if this result set includes the column named +name+
@@ -57,19 +70,14 @@ module ActiveRecord
     # row as parameter.
     #
     # Returns an +Enumerator+ if no block is given.
-    def each
+    def each(&block)
       if block_given?
-        hash_rows.each { |row| yield row }
+        hash_rows.each(&block)
       else
         hash_rows.to_enum { @rows.size }
       end
     end
 
-    alias :map! :map
-    alias :collect! :map
-    deprecate "map!": :map
-    deprecate "collect!": :map
-
     # Returns true if there are no records, otherwise false.
     def empty?
       rows.empty?
@@ -91,6 +99,14 @@ module ActiveRecord
       n ? hash_rows.last(n) : hash_rows.last
     end
 
+    def result # :nodoc:
+      self
+    end
+
+    def cancel # :nodoc:
+      self
+    end
+
     def cast_values(type_overrides = {}) # :nodoc:
       if columns.one?
         # Separated to avoid allocating an array per row
@@ -98,7 +114,7 @@ module ActiveRecord
         type = if type_overrides.is_a?(Array)
           type_overrides.first
         else
-          column_type(columns.first, type_overrides)
+          column_type(columns.first, 0, type_overrides)
         end
 
         rows.map do |(value)|
@@ -108,7 +124,7 @@ module ActiveRecord
         types = if type_overrides.is_a?(Array)
           type_overrides
         else
-          columns.map { |name| column_type(name, type_overrides) }
+          columns.map.with_index { |name, i| column_type(name, i, type_overrides) }
         end
 
         rows.map do |values|
@@ -118,58 +134,55 @@ module ActiveRecord
     end
 
     def initialize_copy(other)
-      @columns      = columns.dup
+      @columns      = columns
       @rows         = rows.dup
       @column_types = column_types.dup
       @hash_rows    = nil
     end
 
+    def freeze # :nodoc:
+      hash_rows.freeze
+      super
+    end
+
+    def column_indexes # :nodoc:
+      @column_indexes ||= begin
+        index = 0
+        hash = {}
+        length  = columns.length
+        while index < length
+          hash[columns[index]] = index
+          index += 1
+        end
+        hash
+      end
+    end
+
     private
-      def column_type(name, type_overrides = {})
+      def column_type(name, index, type_overrides)
         type_overrides.fetch(name) do
-          column_types.fetch(name, Type.default_value)
+          column_types.fetch(index) do
+            column_types.fetch(name, Type.default_value)
+          end
         end
       end
 
       def hash_rows
-        @hash_rows ||=
-          begin
-            # We freeze the strings to prevent them getting duped when
-            # used as keys in ActiveRecord::Base's @attributes hash
-            columns = @columns.map(&:-@)
-            length  = columns.length
-            template = nil
-
-            @rows.map { |row|
-              if template
-                # We use transform_values to build subsequent rows from the
-                # hash of the first row. This is faster because we avoid any
-                # reallocs and in Ruby 2.7+ avoid hashing entirely.
-                index = -1
-                template.transform_values do
-                  row[index += 1]
-                end
-              else
-                # In the past we used Hash[columns.zip(row)]
-                #  though elegant, the verbose way is much more efficient
-                #  both time and memory wise cause it avoids a big array allocation
-                #  this method is called a lot and needs to be micro optimised
-                hash = {}
-
-                index = 0
-                while index < length
-                  hash[columns[index]] = row[index]
-                  index += 1
-                end
-
-                # It's possible to select the same column twice, in which case
-                # we can't use a template
-                template = hash if hash.length == length
-
-                hash
-              end
-            }
-          end
+        # We use transform_values to rows.
+        # This is faster because we avoid any reallocs and avoid hashing entirely.
+        @hash_rows ||= @rows.map do |row|
+          column_indexes.transform_values { |index| row[index] }
+        end
       end
+
+      empty_array = [].freeze
+      EMPTY_HASH = {}.freeze
+      private_constant :EMPTY_HASH
+
+      EMPTY = new(empty_array, empty_array, EMPTY_HASH).freeze
+      private_constant :EMPTY
+
+      EMPTY_ASYNC = FutureResult.wrap(EMPTY).freeze
+      private_constant :EMPTY_ASYNC
   end
 end

data/lib/active_record/runtime_registry.rb

@@ -1,24 +1,82 @@
 # frozen_string_literal: true
 
-require "active_support/per_thread_registry"
-
 module ActiveRecord
   # This is a thread locals registry for Active Record. For example:
   #
-  #   ActiveRecord::RuntimeRegistry.connection_handler
-  #
-  # returns the connection handler local to the current thread.
+  #   ActiveRecord::RuntimeRegistry.sql_runtime
   #
-  # See the documentation of ActiveSupport::PerThreadRegistry
-  # for further details.
-  class RuntimeRegistry # :nodoc:
-    extend ActiveSupport::PerThreadRegistry
+  # returns the connection handler local to the current unit of execution (either thread of fiber).
+  module RuntimeRegistry # :nodoc:
+    extend self
+
+    def sql_runtime
+      ActiveSupport::IsolatedExecutionState[:active_record_sql_runtime] ||= 0.0
+    end
+
+    def sql_runtime=(runtime)
+      ActiveSupport::IsolatedExecutionState[:active_record_sql_runtime] = runtime
+    end
+
+    def async_sql_runtime
+      ActiveSupport::IsolatedExecutionState[:active_record_async_sql_runtime] ||= 0.0
+    end
 
-    attr_accessor :sql_runtime
+    def async_sql_runtime=(runtime)
+      ActiveSupport::IsolatedExecutionState[:active_record_async_sql_runtime] = runtime
+    end
+
+    def queries_count
+      ActiveSupport::IsolatedExecutionState[:active_record_queries_count] ||= 0
+    end
+
+    def queries_count=(count)
+      ActiveSupport::IsolatedExecutionState[:active_record_queries_count] = count
+    end
+
+    def cached_queries_count
+      ActiveSupport::IsolatedExecutionState[:active_record_cached_queries_count] ||= 0
+    end
 
-    [:sql_runtime].each do |val|
-      class_eval %{ def self.#{val}; instance.#{val}; end }, __FILE__, __LINE__
-      class_eval %{ def self.#{val}=(x); instance.#{val}=x; end }, __FILE__, __LINE__
+    def cached_queries_count=(count)
+      ActiveSupport::IsolatedExecutionState[:active_record_cached_queries_count] = count
     end
+
+    def reset
+      reset_runtimes
+      reset_queries_count
+      reset_cached_queries_count
+    end
+
+    def reset_runtimes
+      rt, self.sql_runtime = sql_runtime, 0.0
+      self.async_sql_runtime = 0.0
+      rt
+    end
+
+    def reset_queries_count
+      qc = queries_count
+      self.queries_count = 0
+      qc
+    end
+
+    def reset_cached_queries_count
+      qc = cached_queries_count
+      self.cached_queries_count = 0
+      qc
+    end
+  end
+end
+
+ActiveSupport::Notifications.monotonic_subscribe("sql.active_record") do |name, start, finish, id, payload|
+  unless ["SCHEMA", "TRANSACTION"].include?(payload[:name])
+    ActiveRecord::RuntimeRegistry.queries_count += 1
+    ActiveRecord::RuntimeRegistry.cached_queries_count += 1 if payload[:cached]
+  end
+
+  runtime = (finish - start) * 1_000.0
+
+  if payload[:async]
+    ActiveRecord::RuntimeRegistry.async_sql_runtime += (runtime - payload[:lock_wait])
   end
+  ActiveRecord::RuntimeRegistry.sql_runtime += runtime
 end

data/lib/active_record/sanitization.rb

@@ -5,8 +5,8 @@ module ActiveRecord
     extend ActiveSupport::Concern
 
     module ClassMethods
-      # Accepts an array or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a WHERE clause.
+      # Accepts an array of SQL conditions and sanitizes them into a valid
+      # SQL fragment for a WHERE clause.
       #
       #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id=4"
@@ -17,8 +17,19 @@ module ActiveRecord
       #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id='4'"
       #
+      # This method will NOT sanitize an SQL string since it won't contain
+      # any conditions in it and will return the string as is.
+      #
       #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
       #   # => "name='foo''bar' and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_for_conditions(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_for_conditions(condition)
         return nil if condition.blank?
 
@@ -29,8 +40,8 @@ module ActiveRecord
       end
       alias :sanitize_sql :sanitize_sql_for_conditions
 
-      # Accepts an array, hash, or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a SET clause.
+      # Accepts an array or hash of SQL conditions and sanitizes them into
+      # a valid SQL fragment for a SET clause.
       #
       #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
       #   # => "name=NULL and group_id=4"
@@ -41,8 +52,19 @@ module ActiveRecord
       #   Post.sanitize_sql_for_assignment({ name: nil, group_id: 4 })
       #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
       #
+      # This method will NOT sanitize an SQL string since it won't contain
+      # any conditions in it and will return the string as is.
+      #
       #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
       #   # => "name=NULL and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_for_assignment(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_for_assignment(assignments, default_table_name = table_name)
         case assignments
         when Array; sanitize_sql_array(assignments)
@@ -54,7 +76,7 @@ module ActiveRecord
       # Accepts an array, or string of SQL conditions and sanitizes
       # them into a valid SQL fragment for an ORDER clause.
       #
-      #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
+      #   sanitize_sql_for_order([Arel.sql("field(id, ?)"), [1,3,2]])
       #   # => "field(id, 1,3,2)"
       #
       #   sanitize_sql_for_order("id ASC")
@@ -63,7 +85,7 @@ module ActiveRecord
         if condition.is_a?(Array) && condition.first.to_s.include?("?")
           disallow_raw_sql!(
             [condition.first],
-            permit: connection.column_name_with_order_matcher
+            permit: adapter_class.column_name_with_order_matcher
           )
 
           # Ensure we aren't dealing with a subclass of String that might
@@ -92,26 +114,32 @@ module ActiveRecord
       end
 
       # Sanitizes a +string+ so that it is safe to use within an SQL
-      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
+      # LIKE statement. This method uses +escape_character+ to escape all
+      # occurrences of itself, "_" and "%".
       #
-      #   sanitize_sql_like("100%")
-      #   # => "100\\%"
+      #   sanitize_sql_like("100% true!")
+      #   # => "100\\% true!"
       #
       #   sanitize_sql_like("snake_cased_string")
       #   # => "snake\\_cased\\_string"
       #
-      #   sanitize_sql_like("100%", "!")
-      #   # => "100!%"
+      #   sanitize_sql_like("100% true!", "!")
+      #   # => "100!% true!!"
       #
       #   sanitize_sql_like("snake_cased_string", "!")
       #   # => "snake!_cased!_string"
       def sanitize_sql_like(string, escape_character = "\\")
-        pattern = Regexp.union(escape_character, "%", "_")
-        string.gsub(pattern) { |x| [escape_character, x].join }
+        if string.include?(escape_character) && escape_character != "%" && escape_character != "_"
+          string = string.gsub(escape_character, '\0\0')
+        end
+
+        string.gsub(/(?=[%_])/, escape_character)
       end
 
       # Accepts an array of conditions. The array has each value
-      # sanitized and interpolated into the SQL statement.
+      # sanitized and interpolated into the SQL statement. If using named bind
+      # variables in SQL statements where a colon is required verbatim use a
+      # backslash to escape.
       #
       #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id=4"
@@ -119,77 +147,99 @@ module ActiveRecord
       #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
       #   # => "name='foo''bar' and group_id=4"
       #
+      #   sanitize_sql_array(["TO_TIMESTAMP(:date, 'YYYY/MM/DD HH12\\:MI\\:SS')", date: "foo"])
+      #   # => "TO_TIMESTAMP('foo', 'YYYY/MM/DD HH12:MI:SS')"
+      #
       #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_array(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_array(ary)
         statement, *values = ary
         if values.first.is_a?(Hash) && /:\w+/.match?(statement)
-          replace_named_bind_variables(statement, values.first)
+          with_connection do |c|
+            replace_named_bind_variables(c, statement, values.first)
+          end
         elsif statement.include?("?")
-          replace_bind_variables(statement, values)
+          with_connection do |c|
+            replace_bind_variables(c, statement, values)
+          end
         elsif statement.blank?
           statement
         else
-          statement % values.collect { |value| connection.quote_string(value.to_s) }
+          with_connection do |c|
+            statement % values.collect { |value| c.quote_string(value.to_s) }
+          end
         end
       end
 
-      def disallow_raw_sql!(args, permit: connection.column_name_matcher) # :nodoc:
+      def disallow_raw_sql!(args, permit: adapter_class.column_name_matcher) # :nodoc:
         unexpected = nil
         args.each do |arg|
-          next if arg.is_a?(Symbol) || Arel.arel_node?(arg) || permit.match?(arg.to_s)
+          next if arg.is_a?(Symbol) || Arel.arel_node?(arg) || permit.match?(arg.to_s.strip)
           (unexpected ||= []) << arg
         end
 
         if unexpected
           raise(ActiveRecord::UnknownAttributeReference,
-            "Query method called with non-attribute argument(s): " +
-            unexpected.map(&:inspect).join(", ")
+            "Dangerous query method (method whose arguments are used as raw " \
+            "SQL) called with non-attribute argument(s): " \
+            "#{unexpected.map(&:inspect).join(", ")}." \
+            "This method should not be called with user-provided values, such as request " \
+            "parameters or model attributes. Known-safe values can be passed " \
+            "by wrapping them in Arel.sql()."
           )
         end
       end
 
       private
-        def replace_bind_variables(statement, values)
+        def replace_bind_variables(connection, statement, values)
           raise_if_bind_arity_mismatch(statement, statement.count("?"), values.size)
           bound = values.dup
-          c = connection
           statement.gsub(/\?/) do
-            replace_bind_variable(bound.shift, c)
+            replace_bind_variable(connection, bound.shift)
           end
         end
 
-        def replace_bind_variable(value, c = connection)
+        def replace_bind_variable(connection, value)
           if ActiveRecord::Relation === value
             value.to_sql
           else
-            quote_bound_value(value, c)
+            quote_bound_value(connection, value)
           end
         end
 
-        def replace_named_bind_variables(statement, bind_vars)
-          statement.gsub(/(:?):([a-zA-Z]\w*)/) do |match|
-            if $1 == ":" # skip postgresql casts
+        def replace_named_bind_variables(connection, statement, bind_vars)
+          statement.gsub(/([:\\]?):([a-zA-Z]\w*)/) do |match|
+            if $1 == ":" # skip PostgreSQL casts
               match # return the whole match
+            elsif $1 == "\\" # escaped literal colon
+              match[1..-1] # return match with escaping backlash char removed
             elsif bind_vars.include?(match = $2.to_sym)
-              replace_bind_variable(bind_vars[match])
+              replace_bind_variable(connection, bind_vars[match])
             else
               raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}"
             end
           end
         end
 
-        def quote_bound_value(value, c = connection)
+        def quote_bound_value(connection, value)
           if value.respond_to?(:map) && !value.acts_like?(:string)
             values = value.map { |v| v.respond_to?(:id_for_database) ? v.id_for_database : v }
             if values.empty?
-              c.quote(nil)
+              connection.quote(connection.cast_bound_value(nil))
             else
-              values.map! { |v| c.quote(v) }.join(",")
+              values.map! { |v| connection.quote(connection.cast_bound_value(v)) }.join(",")
             end
           else
             value = value.id_for_database if value.respond_to?(:id_for_database)
-            c.quote(value)
+            connection.quote(connection.cast_bound_value(value))
           end
         end
 

data/lib/active_record/schema.rb

@@ -10,7 +10,7 @@ module ActiveRecord
   #
   # Usage:
   #
-  #   ActiveRecord::Schema.define do
+  #   ActiveRecord::Schema[7.0].define do
   #     create_table :authors do |t|
   #       t.string :name, null: false
   #     end
@@ -30,32 +30,48 @@ module ActiveRecord
   # ActiveRecord::Schema is only supported by database adapters that also
   # support migrations, the two features being very similar.
   class Schema < Migration::Current
-    # Eval the given block. All methods available to the current connection
-    # adapter are available within the block, so you can easily use the
-    # database definition DSL to build up your schema (
-    # {create_table}[rdoc-ref:ConnectionAdapters::SchemaStatements#create_table],
-    # {add_index}[rdoc-ref:ConnectionAdapters::SchemaStatements#add_index], etc.).
-    #
-    # The +info+ hash is optional, and if given is used to define metadata
-    # about the current schema (currently, only the schema's version):
-    #
-    #   ActiveRecord::Schema.define(version: 2038_01_19_000001) do
-    #     ...
-    #   end
-    def self.define(info = {}, &block)
-      new.define(info, &block)
-    end
+    module Definition
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        # Eval the given block. All methods available to the current connection
+        # adapter are available within the block, so you can easily use the
+        # database definition DSL to build up your schema (
+        # {create_table}[rdoc-ref:ConnectionAdapters::SchemaStatements#create_table],
+        # {add_index}[rdoc-ref:ConnectionAdapters::SchemaStatements#add_index], etc.).
+        #
+        # The +info+ hash is optional, and if given is used to define metadata
+        # about the current schema (currently, only the schema's version):
+        #
+        #   ActiveRecord::Schema[7.0].define(version: 2038_01_19_000001) do
+        #     ...
+        #   end
+        def define(info = {}, &block)
+          new.define(info, &block)
+        end
+      end
+
+      def define(info, &block) # :nodoc:
+        connection_pool.with_connection do |connection|
+          instance_eval(&block)
 
-    def define(info, &block) # :nodoc:
-      instance_eval(&block)
+          connection_pool.schema_migration.create_table
+          if info[:version].present?
+            connection.assume_migrated_upto_version(info[:version])
+          end
 
-      if info[:version].present?
-        connection.schema_migration.create_table
-        connection.assume_migrated_upto_version(info[:version])
+          connection_pool.internal_metadata.create_table_and_set_flags(connection_pool.migration_context.current_environment)
+        end
       end
+    end
+
+    include Definition
 
-      ActiveRecord::InternalMetadata.create_table
-      ActiveRecord::InternalMetadata[:environment] = connection.migration_context.current_environment
+    def self.[](version)
+      @class_for_version ||= {}
+      @class_for_version[version] ||= Class.new(Migration::Compatibility.find(version)) do
+        include Definition
+      end
     end
   end
 end