activerecord 4.0.8 → 4.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c4745d3312fd56d5ef5c280dbe53dcad6eb2f4a0
-  data.tar.gz: 96f13ec91a49b5149fdaef774450c1508f436797
+  metadata.gz: 1c03598a80e4948e20c4365cd9c27736d19ff1c9
+  data.tar.gz: 434049ee7aba353e571a54c3b8658a693ea323c0
 SHA512:
-  metadata.gz: 13374d2082e6c5a4c019efffe9295a081b9d7c515e891ee36c8ae46df69fe3e6576a18aa88701033dcaa0d42eeaf2fb9eba0a3547848158cdb4b13b634bafaaa
-  data.tar.gz: 69da6336fe69511f958d08c902d3b6283eb7634ef772136a2189646056cff17cacb37821bfae07c18375e230585be749d26cc2c1d0ca1f9ffd51bbf6e1b455c8
+  metadata.gz: a2009b19504ecb4c0e58fd4c4d527e934bfcf916dcc751250a19b6f216534fb4a2bcbcad81cb13f93e12e4bc3548faffb5325a5df0fab7c7263e5c147d13e5e6
+  data.tar.gz: c07330c8216c0d36a0c5bf0a081550469a36647ac26d4cc43a570ddb93c62bf3044fd4fd8631cf11430193f50fb9f04f7c44b1b09b9f7ab9afbd647a24327dca

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 4.0.9 (August 18, 2014) ##
+
+*   Check attributes passed to `create_with` and `where`.
+
+    Fixes CVE-2014-3514.
+
+    *Rafael Mendonça França*
+
+
 ## Rails 4.0.8 (July 2, 2014) ##
 
 *   Fix regression added from the latest security fix.

data/lib/active_record/relation/query_methods.rb

@@ -1,9 +1,12 @@
 require 'active_support/core_ext/array/wrap'
+require 'active_model/forbidden_attributes_protection'
 
 module ActiveRecord
   module QueryMethods
     extend ActiveSupport::Concern
 
+    include ActiveModel::ForbiddenAttributesProtection
+
     # WhereChain objects act as placeholder for queries in which #where does not have any parameter.
     # In this case, #where must be chained with #not to return a new relation.
     class WhereChain
@@ -540,7 +543,10 @@ module ActiveRecord
       if opts == :chain
         WhereChain.new(self)
       else
-        references!(PredicateBuilder.references(opts)) if Hash === opts
+        if Hash === opts
+          opts = sanitize_forbidden_attributes(opts)
+          references!(PredicateBuilder.references(opts))
+        end
 
         self.where_values += build_where(opts, rest)
         self
@@ -678,7 +684,13 @@ module ActiveRecord
     end
 
     def create_with!(value) # :nodoc:
-      self.create_with_value = value ? create_with_value.merge(value) : {}
+      if value
+        value = sanitize_forbidden_attributes(value)
+        self.create_with_value = create_with_value.merge(value)
+      else
+        self.create_with_value = {}
+      end
+
       self
     end
 

data/lib/active_record/version.rb

@@ -1,7 +1,7 @@
 module ActiveRecord
   # Returns the version of the currently loaded ActiveRecord as a Gem::Version
   def self.version
-    Gem::Version.new "4.0.8"
+    Gem::Version.new "4.0.9"
   end
 
   module VERSION #:nodoc:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 4.0.8
+  version: 4.0.9
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-07-02 00:00:00.000000000 Z
+date: 2014-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.0.8
+        version: 4.0.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.0.8
+        version: 4.0.9
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.0.8
+        version: 4.0.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.0.8
+        version: 4.0.9
 - !ruby/object:Gem::Dependency
   name: arel
   requirement: !ruby/object:Gem::Requirement
@@ -265,3 +265,4 @@ signing_key:
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).
 test_files: []
+has_rdoc: