hightop 0.2.4 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e986b06b74104ea5fb99fe92abdb061eab4cc225ba9fa4f34216eadcd704e556
-  data.tar.gz: 5ca8954b8ce39c1212e0bc0b651e22450ff26b17795665b561cc7e4bbb134067
+  metadata.gz: ee918ba56e73e37d1c623e99f4bf2971f1f99a82a369582eaf78144951dab192
+  data.tar.gz: c626b6953aae5d3e43e00291b5fba24d8326d133f5aba945ab58f59f4defcb65
 SHA512:
-  metadata.gz: e9d93d7b9edcce9dcfb6f3b7912ef3252454731bcc68d45cc9ff391df854a6fe49e5d7ca269780e55e98cf1481a17ef3472427de69694d6098cfdcacf9e61c7d
-  data.tar.gz: cd86dfd59b77d39482d06d0a6e9f59869ca15eaab6eef6e5cc62f754ad9d3addd781e21749a192a181385620b2508b520ee22da1f2c397566ac82159778a65d2
+  metadata.gz: e82a5854442ce691bc664cf6bb32aa1db21ec5e527fbc4c2ff9ddca49c8b278b8edc454cb0178ddc147ab47db324b091a65840783c9912a3051c16185bf45be3
+  data.tar.gz: '0978f96d0c782e7e6cb9221c11ea01f1ec55ebc1e287fec595416b587f64d30dbe8dcda0859a18d81445ea5900b21c3acf1838cb9c29592bfa76a192f7bd76d2'

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.3.0 (2021-08-12)
+
+- Raise `ActiveRecord::UnknownAttributeReference` for non-attribute arguments
+- Raise `ArgumentError` for too many arguments with enumerable
+- Removed `uniq` option (use `distinct` instead)
+- Dropped support for Active Record < 5.2 and Ruby < 2.6
+
 ## 0.2.4 (2020-09-07)
 
 - Added warning for non-attribute argument

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2014-2020 Andrew Kane
+Copyright (c) 2014-2021 Andrew Kane
 
 MIT License
 

data/README.md

@@ -13,7 +13,7 @@ Visit.top(:browser)
 
 Works with Active Record, Mongoid, arrays and hashes
 
-[![Build Status](https://travis-ci.org/ankane/hightop.svg?branch=master)](https://travis-ci.org/ankane/hightop)
+[![Build Status](https://github.com/ankane/hightop/workflows/build/badge.svg?branch=master)](https://github.com/ankane/hightop/actions)
 
 ## Installation
 
@@ -61,19 +61,6 @@ And min count
 Visit.top(:city, min: 10)
 ```
 
-## User Input
-
-If passing user input as the column, be sure to sanitize it first [like you must](https://rails-sqli.org/) with `group`.
-
-```ruby
-column = params[:column]
-
-# check against permitted columns
-raise "Unpermitted column" unless ["column_a", "column_b"].include?(column)
-
-User.top(column)
-```
-
 ## Arrays and Hashes
 
 Arrays
@@ -106,6 +93,18 @@ Min count
 ["up", "up", "down"].top(min: 2)
 ```
 
+## Upgrading
+
+### 0.3.0
+
+Hightop 0.3.0 protects against unsafe input by default. For non-attribute arguments, use:
+
+```ruby
+Visit.top(Arel.sql(known_safe_value))
+```
+
+Also, the `uniq` option has been removed. Use `distinct` instead.
+
 ## History
 
 View the [changelog](https://github.com/ankane/hightop/blob/master/CHANGELOG.md)
@@ -119,7 +118,7 @@ Everyone is encouraged to help improve this project. Here are a few ways you can
 - Write, clarify, or fix documentation
 - Suggest or add new features
 
-To get started with development and testing:
+To get started with development:
 
 ```sh
 git clone https://github.com/ankane/hightop.git

data/lib/hightop/enumerable.rb

@@ -1,7 +1,8 @@
 module Enumerable
   def top(*args, **options, &block)
     if block || !(respond_to?(:scoping) || respond_to?(:with_scope))
-      # TODO raise error if too many arguments
+      raise ArgumentError, "wrong number of arguments (given 2, expected 0..1)" if args.size > 1
+
       limit = args[0]
       min = options[:min]
 

data/lib/hightop/kicks.rb

@@ -1,13 +1,10 @@
 module Hightop
   module Kicks
-    def top(column, limit = nil, distinct: nil, uniq: nil, min: nil, nil: nil)
-      warn "[hightop] uniq is deprecated. Use distinct instead" if uniq
-
+    def top(column, limit = nil, distinct: nil, min: nil, nil: nil)
       columns = column.is_a?(Array) ? column : [column]
-      columns.each { |c| Utils.validate_column(c) }
+      columns = columns.map { |c| Utils.validate_column(c) }
 
-      distinct ||= uniq
-      Utils.validate_column(distinct) if distinct
+      distinct = Utils.validate_column(distinct) if distinct
 
       relation = group(*columns).order("1 DESC", *columns)
       if limit

data/lib/hightop/mongoid.rb

@@ -2,13 +2,9 @@ module Hightop
   module Mongoid
     # super helpful article
     # https://maximomussini.com/posts/mongoid-aggregation-dsl/
-    def top(column, limit = nil, distinct: nil, uniq: nil, min: nil, nil: nil)
-      warn "[hightop] uniq is deprecated. Use distinct instead" if uniq
-
+    def top(column, limit = nil, distinct: nil, min: nil, nil: nil)
       columns = column.is_a?(Array) ? column : [column]
 
-      distinct ||= uniq
-
       relation = all
 
       # terribly named option

data/lib/hightop/utils.rb

@@ -5,9 +5,13 @@ module Hightop
       # symbol = column (safe), Arel node = SQL (safe), other = untrusted
       # matches table.column and column
       def validate_column(column)
-        unless column.is_a?(Symbol) || column.is_a?(Arel::Nodes::SqlLiteral) || /\A\w+(\.\w+)?\z/i.match(column.to_s)
-          warn "[hightop] Non-attribute argument: #{column}. Use Arel.sql() for known-safe values. This will raise an error in Hightop 0.3.0"
+        unless column.is_a?(Symbol) || column.is_a?(Arel::Nodes::SqlLiteral)
+          column = column.to_s
+          unless /\A\w+(\.\w+)?\z/i.match(column)
+            raise ActiveRecord::UnknownAttributeReference, "Query method called with non-attribute argument(s): #{column.inspect}. Use Arel.sql() for known-safe values."
+          end
         end
+        column
       end
 
       # resolves eagerly

data/lib/hightop/version.rb

@@ -1,3 +1,3 @@
 module Hightop
-  VERSION = "0.2.4"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hightop
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.3.0
 platform: ruby
 authors:
 - Andrew Kane
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-09-07 00:00:00.000000000 Z
+date: 2021-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,72 +16,16 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '5.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '5'
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description: 
-email: andrew@chartkick.com
+        version: '5.2'
+description:
+email: andrew@ankane.org
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -99,7 +43,7 @@ homepage: https://github.com/ankane/hightop
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -107,15 +51,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.2.22
+signing_key:
 specification_version: 4
 summary: A nice shortcut for group count queries
 test_files: []