activerecord 3.2.18 → 3.2.19

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 3.2.19 (Jul 2, 2014) ##
+
+*   Fix SQL Injection Vulnerability in 'bitstring' quoting.
+
+    Fixes CVE-2014-3482.
+
+    *Rafael Mendonça França*
+
+
 ## Rails 3.2.18 (May 6, 2014) ##
 
 * No changes.

data/lib/active_record/connection_adapters/postgresql_adapter.rb

@@ -442,8 +442,8 @@ module ActiveRecord
           when 'xml'   then "xml '#{quote_string(value)}'"
           when /^bit/
             case value
-            when /^[01]*$/      then "B'#{value}'" # Bit-string notation
-            when /^[0-9A-F]*$/i then "X'#{value}'" # Hexadecimal notation
+            when /\A[01]*\Z/      then "B'#{value}'" # Bit-string notation
+            when /\A[0-9A-F]*\Z/i then "X'#{value}'" # Hexadecimal notation
             end
           else
             super
@@ -1160,7 +1160,7 @@ module ActiveRecord
         FEATURE_NOT_SUPPORTED = "0A000" # :nodoc:
 
         def exec_no_cache(sql, binds)
-          @connection.async_exec(sql)
+          @connection.async_exec(sql, [])
         end
 
         def exec_cache(sql, binds)

data/lib/active_record/session_store.rb

@@ -9,7 +9,7 @@ module ActiveRecord
   #
   # The default assumes a +sessions+ tables with columns:
   #   +id+ (numeric primary key),
-  #   +session_id+ (text, or longtext if your session data exceeds 65K), and
+  #   +session_id+ (string, :limit => 255), and
   #   +data+ (text or longtext; careful if your session data exceeds 65KB).
   #
   # The +session_id+ column should always be indexed for speedy lookups.

data/lib/active_record/version.rb

@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 18
+    TINY  = 19
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: activerecord
 version: !ruby/object:Gem::Version 
-  hash: 43
+  hash: 41
   prerelease: 
   segments: 
   - 3
   - 2
-  - 18
-  version: 3.2.18
+  - 19
+  version: 3.2.19
 platform: ruby
 authors: 
 - David Heinemeier Hansson
@@ -15,44 +15,43 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2014-05-06 00:00:00 Z
+date: 2014-07-02 00:00:00 -03:00
+default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  type: :runtime
-  name: activesupport
-  version_requirements: &id001 !ruby/object:Gem::Requirement 
+  requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        hash: 43
+        hash: 41
         segments: 
         - 3
         - 2
-        - 18
-        version: 3.2.18
+        - 19
+        version: 3.2.19
+  type: :runtime
+  version_requirements: *id001
   prerelease: false
-  requirement: *id001
+  name: activesupport
 - !ruby/object:Gem::Dependency 
-  type: :runtime
-  name: activemodel
-  version_requirements: &id002 !ruby/object:Gem::Requirement 
+  requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        hash: 43
+        hash: 41
         segments: 
         - 3
         - 2
-        - 18
-        version: 3.2.18
+        - 19
+        version: 3.2.19
+  type: :runtime
+  version_requirements: *id002
   prerelease: false
-  requirement: *id002
+  name: activemodel
 - !ruby/object:Gem::Dependency 
-  type: :runtime
-  name: arel
-  version_requirements: &id003 !ruby/object:Gem::Requirement 
+  requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
@@ -63,12 +62,12 @@ dependencies:
         - 0
         - 2
         version: 3.0.2
+  type: :runtime
+  version_requirements: *id003
   prerelease: false
-  requirement: *id003
+  name: arel
 - !ruby/object:Gem::Dependency 
-  type: :runtime
-  name: tzinfo
-  version_requirements: &id004 !ruby/object:Gem::Requirement 
+  requirement: &id004 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
@@ -79,8 +78,10 @@ dependencies:
         - 3
         - 29
         version: 0.3.29
+  type: :runtime
+  version_requirements: *id004
   prerelease: false
-  requirement: *id004
+  name: tzinfo
 description: Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.
 email: david@loudthinking.com
 executables: []
@@ -239,6 +240,7 @@ files:
 - lib/rails/generators/active_record/session_migration/session_migration_generator.rb
 - lib/rails/generators/active_record/session_migration/templates/migration.rb
 - lib/rails/generators/active_record.rb
+has_rdoc: true
 homepage: http://www.rubyonrails.org
 licenses: 
 - MIT
@@ -271,7 +273,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.8.15
+rubygems_version: 1.6.2
 signing_key: 
 specification_version: 3
 summary: Object-relational mapper framework (part of Rails).