cuttable 0.0.6 → 0.0.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +19 -20
- data/cuttable.gemspec +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 66188d11cb703de306698c00bba927c82325854d5ec30d83ac48bc57cc6dc38b
|
|
4
|
+
data.tar.gz: 07d363bf2de3804fb9fca0cdc7865ae535ab29b4e6fb4345ab914f42de7a343b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 68e7be881d179722fc7fcd036d8d3210149bdb67b6f4b6d856b64d740deed61ae74601bb5f4e3b19806c4e784aef041d4859760a32a70502a3caa2c564d662e5
|
|
7
|
+
data.tar.gz: 379ac423bc212c0555e77c91e9a5384939cf4b3ce3f8fe407507fb5990c3e2edd97a82cf3a4c17d29bb39451ff3194b070ab084bd93b65dec051c9d3b90e4239
|
data/README.md
CHANGED
|
@@ -1,36 +1,35 @@
|
|
|
1
1
|
# cuttable
|
|
2
2
|
Escape SQL injection when you order with params
|
|
3
3
|
|
|
4
|
-
|
|
4
|
+
## Getting started
|
|
5
5
|
|
|
6
6
|
1. Add inside your Gemfile
|
|
7
7
|
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
```
|
|
8
|
+
gem 'cuttable'
|
|
9
|
+
|
|
11
10
|
|
|
12
11
|
2. Include concern and execute default_order to set default order for
|
|
13
12
|
sanitize_order method.
|
|
14
13
|
|
|
15
|
-
```ruby
|
|
16
|
-
class User < ActiveRecord::Base
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
end
|
|
20
|
-
```
|
|
14
|
+
```ruby
|
|
15
|
+
class User < ActiveRecord::Base
|
|
16
|
+
include Cuttable # include concern
|
|
17
|
+
default_order 'id desc' # set default order for sanitize_order method
|
|
18
|
+
end
|
|
19
|
+
```
|
|
21
20
|
|
|
22
|
-
|
|
21
|
+
## Usage
|
|
23
22
|
|
|
24
23
|
```ruby
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
24
|
+
# good queries
|
|
25
|
+
params[:order] = 'id DESC'
|
|
26
|
+
User.sanitize_order(params[:order])
|
|
28
27
|
|
|
29
|
-
|
|
30
|
-
|
|
28
|
+
params[:order] = 'id, username DESC'
|
|
29
|
+
User.sanitize_order(params[:order])
|
|
31
30
|
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
31
|
+
# bad query
|
|
32
|
+
params[:order] = 'id, (select sleep(2000) from dual where database() like database())#'
|
|
33
|
+
# it should back off to the default query you set with default_order
|
|
34
|
+
User.sanitize_order(params[:order])
|
|
36
35
|
```
|
data/cuttable.gemspec
CHANGED