arel-extensions 9.0.0 → 9.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2cac2b9e201296fa2c9e058f38cd0acf4835b134f2f98bb74f245af78b58f02c
-  data.tar.gz: 8b4be319b4037c1dfb2c54d6d9314a6add237ac60ec1fe2e6e1f0d396d67d1bb
+  metadata.gz: 99efadd34c12e304c5204c9dc2717bad533bfb20c9c280a036a8abc3110ab34a
+  data.tar.gz: 66c064d703b2531c7676e3a91bef9f0dd813355e24108c7966770ea1fba298ff
 SHA512:
-  metadata.gz: 36818826669a7004657c3362908fc8c11bb683fabbf93183dde33cb4a933ce3e5bd41da637cfd2c48906fab72d8ed22992802aa44daa69d7919cc3ccc62faffe
-  data.tar.gz: 17ae44d0099f00b6193f3e94aaa50830556e191d728bc3580b4164fae8f4b6b9f808cea2d3925ffe73cd5a30ea5501be6d393b428e23b01d6b4ee63dfd9d5d32
+  metadata.gz: 043be028082fea8d31c8b427db8a703b7f4a2f1916879e77455f05847086964840b4cae0886e73930ace056dc9e86bcb7c375c4794a64f5ac5a85c19d5f9b61b
+  data.tar.gz: 89d8e35f5503774cc499c93fa0cc9ea427dec2cecc27cd6ee01f5d52f9f66f9c278078c80c865d7fc4bac8362e9c860f7fe33b1a90b572c4823621cfe6be9ba3

data/CHANGELOG.md

@@ -1,4 +1,27 @@
-## [9.0.0] - Unreleased
+## [9.0.1] - 2026-08-30
+
+### Security
+- Fixed a SQL injection in the PostgreSQL visitor's JSON path handling
+  ([GHSA-75hc-9q9v-9cv2], CWE-89, high). `key`/`dig` path segments were
+  interpolated straight into a `#>'{...}'` array literal, so a segment
+  containing `}'` could close the literal and have the rest of it executed as
+  SQL. Most reachable through activerecord-filter, where a filter key like
+  `"metadata.<payload>"` on a json/jsonb column puts request input into `dig`.
+  Segments are now emitted as a quoted `#> array[...]`, which PostgreSQL folds
+  back to the same `text[]` constant (existing expression indexes still match).
+  Reported by [@saidM](https://github.com/saidM).
+- `cast_as` now validates the type name and raises `ArgumentError` unless it
+  looks like a type identifier. Not reachable from activerecord-filter, but it
+  was the same class of raw interpolation.
+
+### Changed
+- A path segment is now always a single segment: `key('a,b')` emits
+  `array['a,b']`, where the old raw `'{a,b}'` literal let PostgreSQL split it
+  on the comma into two segments. Use `dig('a', 'b')` for multi-segment paths.
+
+[GHSA-75hc-9q9v-9cv2]: https://github.com/malomalo/arel-extensions/security/advisories/GHSA-75hc-9q9v-9cv2
+
+## [9.0.0] - 2026-08-27
 
 ### Changed
 - Switched to independent Semantic Versioning. Prior releases tracked the Rails

data/README.md

@@ -63,14 +63,44 @@ tags.excludes(other)       # NOT (tags @> other)
 ```ruby
 data = User.arel_table[:data]
 
-data.key('name')            # data #>'{name}'   (aliases: data['name'], data.index('name'))
-data.dig('address', 'zip')  # data #>'{address,zip}'
+# Keys in a Object
+data['name']                # data #> array['name']
+data.key('name')            # data #> array['name']
+data.index('name')          # data #> array['name']
+
+# Integer index in a Array
+data[0]                     # data #> array['0']
+data.key(0)                 # data #> array['0']
+data.index(0)               # data #> array['0']
+
+# Dig and other operators
+data.dig('address', 'zip')  # data #> array['address','zip']
+data.dig('tags', -1)        # data #> array['tags','-1']
 data.has_key('name')        # data ? 'name'
 data.has_keys('a', 'b')     # data ?& array['a','b']
 data.has_any_key('a', 'b')  # data ?| array['a','b']
-data.cast_as('int')         # (data)::int
 ```
 
+A segment may be an integer, which PostgreSQL reads as an array index (negative
+counts from the end); out of range yields `NULL`.
+
+Path segments are quoted, so they are safe to build from untrusted input.
+PostgreSQL folds the array back to `'{address,zip}'::text[]`, so expression
+indexes written against the literal form still match.
+
+### Casting
+
+```ruby
+User.arel_table[:id].cast_as('text')            # (users.id)::text
+User.arel_table[:created_at].cast_as('date')    # (users.created_at)::date
+data.dig('age').cast_as('int')                  # (data #> array['age'])::int
+```
+
+A type name can't be quoted or bound, so `cast_as` accepts only something that
+looks like one; optionally schema qualified, with a modifier. For example:
+`text`, `varchar(255)`, `numeric(10,2)`, `timestamp(6) with time zone`,
+`int[]`, `public.geometry`. An `ArgumentError` will be raised otherwise.
+
 ### Full-text search
 
 ```ruby

data/lib/arel/extensions/version.rb

@@ -2,6 +2,6 @@
 
 module Arel
   module Extensions
-    VERSION = '9.0.0'
+    VERSION = '9.0.1'
   end
 end

data/lib/arel/visitors/postgresql_extensions.rb

@@ -39,24 +39,24 @@ module Arel
         collector
       end
 
-      def visit_Arel_Attributes_Key(o, collector, last_key = true)
-        if o.relation.is_a?(Arel::Attributes::Key)
-          visit_Arel_Attributes_Key(o.relation, collector, false)
-          if last_key
-            collector << o.name.to_s
-            collector << "}'"
-          else
-            collector << o.name.to_s
-            collector << ","
-          end
-        else
-          visit(o.relation, collector)
-          collector << "\#>'{" << o.name.to_s
-          collector << (last_key ? "}'" : ",")
+      # Path segments are emitted as a quoted `array[...]` rather than
+      # interpolated into a `'{...}'` array literal, so a segment can never
+      # break out of the path and inject SQL (GHSA-75hc-9q9v-9cv2). PostgreSQL
+      # const-folds the array back to `'{a,b}'::text[]`, so expression indexes
+      # on the literal form still match.
+      def visit_Arel_Attributes_Key(o, collector)
+        keys = []
+        node = o
+        while node.is_a?(Arel::Attributes::Key)
+          keys.unshift(quote(node.name.to_s))
+          node = node.relation
         end
+
+        visit(node, collector)
+        collector << " #> array[" << keys.join(',') << "]"
         collector
       end
-
+      
       def visit_Arel_Nodes_HasKey(o, collector)
         right = o.right
 
@@ -84,10 +84,24 @@ module Arel
         collector
       end
 
+      # A type name can't be bound or quoted, so only allow something that
+      # actually looks like one -- optionally schema qualified, with a modifier
+      # and/or array suffix. Keeps user input from reaching the SQL as-is.
+      CAST_TYPE = /\A
+        [a-z_][a-z0-9_]*(\.[a-z_][a-z0-9_]*)?  # type, optionally schema qualified
+        (\(\d+(\s*,\s*\d+)?\))?                # "varchar(255)", "numeric(10,2)"
+        (\ [a-z]+)*                            # "timestamp with time zone"
+        (\(\d+(\s*,\s*\d+)?\))?                # "character varying(255)"
+        (\[\])*                                # "int[]"
+      \z/xi
+      
       def visit_Arel_Attributes_Cast(o, collector)
+        type = o.name.to_s
+        raise ArgumentError, "invalid cast type: #{type.inspect}" unless CAST_TYPE.match?(type)
+
         collector << "("
         visit(o.relation, collector)
-        collector << ")::#{o.name}"
+        collector << ")::#{type}"
         collector
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: arel-extensions
 version: !ruby/object:Gem::Version
-  version: 9.0.0
+  version: 9.0.1
 platform: ruby
 authors:
 - Jon Bracy