forest_admin_agent 1.36.0 → 1.36.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59bcabb74959ab090658d106c743b18c6503f75b085ad32c9282288a2ece4963
-  data.tar.gz: 66c2283f513b2f22d603b16f30480713992879a31fb46985f14dd7cf74b94c0a
+  metadata.gz: 8dfe78a2ed0c19256af6975b916fedd900f5ec28e5cb2ab5d5e712a8d28621f0
+  data.tar.gz: 7681368ebd2a38978c141d8dc509be092de45daab2ee1613426f4964b0128695
 SHA512:
-  metadata.gz: de2234332df46b3fbe7ddfeaf7425df1f0e789d39e9c0cba722044508f03019cabffe700edf977160beb1a087c96d07deb67f65b3e0ca1c8f4e31706be03c909
-  data.tar.gz: 8dd2c52e79c5253e7618ef9c70a93db8f4920bb56f96b9b7c2da5d6afb220fcc704d29f10019ecee4901d8d6e5755087dbb2067da3c024c2bf6dc3e7697a1c2a
+  metadata.gz: d64027002baa55f8ec4a4d9e6b4f8ba049bc304df687e3da6605cd245c998b0716a4fc59ac81666811503aeabab5e80806322511277c13b7ea8b18f947e6c78b
+  data.tar.gz: 6afcca1e58e83c2edea354af8bff76aed1d9adeecba94289dc3d37718a4dc8305fe0ed104c00edd7f884532dc858c1c0b116d7fa928540bda157822ad4bd2ae3

data/lib/forest_admin_agent/routes/query_handler.rb

@@ -16,14 +16,10 @@ module ForestAdminAgent
 
       def execute_query(datasource, query, connection_name, permissions, caller, context_variables)
         query = query.strip
-        query, context_variables = inject_context_variables(datasource, connection_name, query, permissions, caller,
-                                                            context_variables)
-
-        datasource.execute_native_query(
-          connection_name,
-          query,
-          context_variables.values
-        )
+        query, binds = inject_context_variables(datasource, connection_name, query, permissions, caller,
+                                                context_variables)
+
+        datasource.execute_native_query(connection_name, query, binds)
       end
 
       def parse_query_segment(collection, args, permissions, caller)

data/lib/forest_admin_agent/routes/resources/native_query.rb

@@ -36,7 +36,7 @@ module ForestAdminAgent
 
           context.permissions.can_chart?(args[:params])
 
-          query.gsub!('?', args[:params][:record_id].to_s) if args[:params][:record_id]
+          query, context_variables = inject_record_id(query, args[:params])
           type = validate_and_get_type(args[:params][:type])
           result = execute_query(
             context.datasource,
@@ -44,7 +44,7 @@ module ForestAdminAgent
             args[:params][:connectionName],
             context.permissions,
             context.caller,
-            args[:params][:contextVariables]
+            context_variables
           )
 
           { content: Serializer::ForestChartSerializer.serialize(send(:"make_#{type}", result)) }
@@ -52,6 +52,19 @@ module ForestAdminAgent
 
         private
 
+        # The developer's query template uses a literal '?' to mean "the record this chart is
+        # scoped to". Substituting record_id as text into the query (the previous approach) let
+        # an attacker inject arbitrary SQL through it - route it through the same {{...}} bind
+        # machinery used for context variables instead, so it's a real parameter, never SQL text.
+        def inject_record_id(query, params)
+          context_variables = params[:contextVariables]
+          context_variables = {} unless context_variables.is_a?(Hash)
+
+          return [query, context_variables] unless params[:record_id]
+
+          [query.gsub('?', '{{__record_id__}}'), context_variables.merge('__record_id__' => params[:record_id])]
+        end
+
         def validate_and_get_type(type)
           chart_types = %w[Value Objective Pie Line Leaderboard]
           unless chart_types.include?(type)

data/lib/forest_admin_agent/services/permissions.rb

@@ -148,6 +148,12 @@ module ForestAdminAgent
         team = get_team(caller.rendering_id)
         user = get_user_data(caller.id)
 
+        if team.nil? || user.nil?
+          raise ForestAdminDatasourceToolkit::Exceptions::ForestException,
+                "Unable to resolve the caller's team or user data while computing the permission " \
+                "scope for '#{collection.name}'."
+        end
+
         context_variables = ContextVariables.new(team, user)
 
         ContextVariablesInjector.inject_context_in_filter(scope, context_variables)

data/lib/forest_admin_agent/utils/context_variables.rb

@@ -10,14 +10,22 @@ module ForestAdminAgent
       USER_VALUE_TEAM_PREFIX = 'currentUser.team.'.freeze
 
       def initialize(team, user, request_context_variables = nil)
-        @team = team.transform_keys(&:to_sym)
-        @user = user.transform_keys(&:to_sym)
-        @request_context_variables = request_context_variables
+        @team = (team || {}).transform_keys(&:to_sym)
+        @user = (user || {}).transform_keys(&:to_sym)
+        @request_context_variables = request_context_variables.is_a?(Hash) ? request_context_variables : {}
       end
 
       def get_value(context_variable_key)
         return get_current_user_data(context_variable_key) if context_variable_key.start_with?(USER_VALUE_PREFIX)
 
+        if request_context_variables.empty?
+          ForestAdminAgent::Facades::Container.logger&.log(
+            'Warn',
+            "Context variable '#{context_variable_key}' could not be resolved: no request context " \
+            'variables were provided.'
+          )
+        end
+
         request_context_variables[context_variable_key]
       end
 

data/lib/forest_admin_agent/utils/context_variables_injector.rb

@@ -1,3 +1,5 @@
+require 'json'
+
 module ForestAdminAgent
   module Utils
     class ContextVariablesInjector
@@ -5,55 +7,131 @@ module ForestAdminAgent
       include ForestAdminAgent::Builder
 
       REGEX = /{{([^}]+)}}/
+      FULL_REFERENCE_REGEX = /\A{{([^}]+)}}\z/
+      COMMENT_MARKERS = ['--', '/*'].freeze
 
       def self.inject_context_in_value(value, context_variables)
+        return value unless value.is_a?(String)
+
+        # A value that is exactly one {{variable}} reference (no surrounding text) keeps the
+        # resolved object as-is, so a jsonb/array field gets typed-cast correctly by the
+        # datasource instead of being compared against a serialized string that can never match.
+        full_reference = FULL_REFERENCE_REGEX.match(value)
+        return context_variables.get_value(full_reference[1]) if full_reference
+
         inject_context_in_value_custom(value) do |context_variable_key|
-          context_variables.get_value(context_variable_key).to_s
+          serialize_for_injection(context_variables.get_value(context_variable_key))
         end
       end
 
+      def self.serialize_for_injection(resolved_value)
+        return JSON.generate(resolved_value) if resolved_value.is_a?(Array) || resolved_value.is_a?(Hash)
+
+        resolved_value.to_s
+      end
+
       def self.inject_context_in_native_query(datasource, connection_name, query, context_variables)
         return query unless query.is_a?(String)
 
-        query_with_context_variables_injected = query
-        encountered_variables = {}
+        state = { binds: [], replacements: {}, reusable: nil }
 
-        while (match = REGEX.match(query_with_context_variables_injected))
-          context_variable_key = match[1]
+        injected_query = query.gsub(REGEX) do
+          key = ::Regexp.last_match(1)
+          raise_unless_live_sql(key, ::Regexp.last_match.pre_match)
+          resolve_bind_symbol(key, datasource, connection_name, context_variables, state)
+        end
 
-          next if encountered_variables.value?(context_variable_key)
+        [injected_query, state[:binds]]
+      end
 
-          index = datasource.build_binding_symbol(connection_name, encountered_variables)
-          query_with_context_variables_injected.gsub!(
-            /{{#{context_variable_key}}}/,
-            index
-          )
-          encountered_variables[index] = context_variables.get_value(context_variable_key)
+      # A repeated key's bind can be reused (true, e.g. postgres' $N) or needs a fresh slot per
+      # occurrence (false, e.g. "?", purely positional) - unknown until the first repeat, since
+      # build_binding_symbol can't declare it upfront. Reusing when unsafe drops a bind value a
+      # positional driver needs; always assuming fresh costs an extra RPC round-trip.
+      def self.resolve_bind_symbol(key, datasource, connection_name, context_variables, state)
+        if state[:replacements].key?(key)
+          if state[:reusable].nil?
+            probe = datasource.build_binding_symbol(connection_name, state[:binds])
+            state[:reusable] = (probe != state[:replacements][key])
+          end
+
+          state[:binds] << context_variables.get_value(key) unless state[:reusable]
+          state[:replacements][key]
+        else
+          symbol = datasource.build_binding_symbol(connection_name, state[:binds])
+          state[:binds] << context_variables.get_value(key)
+          state[:replacements][key] = symbol
         end
+      end
+
+      # A placeholder inside a quoted string, a "quoted identifier", or a SQL comment can never
+      # be a real bind, so scan everything before the match for one. Both quote styles share the
+      # same escape convention (a doubled quote character, never a boundary) so one `quote`
+      # variable tracks whichever is currently open. Comments are skipped wholesale rather than
+      # scanned char by char - a naive quote count would misfire on an apostrophe inside one (e.g.
+      # -- user's note).
+      def self.sql_context_before(text)
+        quote = nil
+        i = 0
+
+        while i < text.length
+          if quote
+            if text[i] == quote && text[i + 1] == quote
+              i += 1
+            elsif text[i] == quote
+              quote = nil
+            end
+          elsif /['"]/.match?(text[i])
+            quote = text[i]
+          elsif COMMENT_MARKERS.include?(text[i, 2])
+            i = skip_sql_comment(text, i)
+            return :comment if i.nil?
+
+            next
+          end
 
-        [query_with_context_variables_injected, encountered_variables]
+          i += 1
+        end
+
+        return :code unless quote
+
+        quote == "'" ? :string : :identifier
       end
 
-      def self.inject_context_in_value_custom(value)
-        return value unless value.is_a?(String)
+      def self.skip_sql_comment(text, index)
+        return text.index("\n", index)&.succ if text[index, 2] == '--'
 
-        value_with_context_variables_injected = value
-        encountered_variables = []
+        text.index('*/', index + 2)&.succ&.succ
+      end
 
-        while (match = REGEX.match(value_with_context_variables_injected))
-          context_variable_key = match[1]
+      PLACEHOLDER_CONTEXT_ERRORS = {
+        string: 'is inside a quoted string literal, which native query bindings do not support',
+        comment: 'is inside a SQL comment, which native query bindings do not support',
+        identifier: 'is inside a quoted identifier - a bind can only ever be a value, never a column or table name'
+      }.freeze
 
-          unless encountered_variables.include?(context_variable_key)
-            value_with_context_variables_injected.gsub!(
-              /{{#{context_variable_key}}}/,
-              yield(context_variable_key)
-            )
-          end
+      def self.raise_unless_live_sql(key, text_before_match)
+        context = sql_context_before(text_before_match)
+        return if context == :code
 
-          encountered_variables.push(context_variable_key)
-        end
+        raise ForestAdminDatasourceToolkit::Exceptions::ForestException,
+              "The '{{#{key}}}' placeholder #{PLACEHOLDER_CONTEXT_ERRORS[context]}."
+      end
+
+      def self.inject_context_in_value_custom(value)
+        return value unless value.is_a?(String)
+
+        # Resolve every distinct {{key}} found in the ORIGINAL string upfront, then substitute
+        # in a single gsub pass. A resolved value can itself contain "{{...}}"-looking text (e.g.
+        # a tag whose data happens to include it); re-scanning a mutated string for placeholders
+        # (the previous while+gsub! approach) would misinterpret that text as a new reference, or
+        # loop forever if it matched an already-resolved key without ever changing the string.
+        keys = value.scan(REGEX).map(&:first).uniq
+        return value if keys.empty?
+
+        replacements = keys.to_h { |key| [key, yield(key)] }
 
-        value_with_context_variables_injected
+        value.gsub(REGEX) { replacements[::Regexp.last_match(1)] }
       end
 
       def self.inject_context_in_filter(filter, context_variables)

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.36.0"
+        LIANA_VERSION = "1.36.2"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.36.0"
+  VERSION = "1.36.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.36.0
+  version: 1.36.2
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-24 00:00:00.000000000 Z
+date: 2026-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport