pg_search 2.3.7 → 2.3.8

data/lib/pg_search/features/tsearch.rb

@@ -49,12 +49,8 @@ module PgSearch
 
         %w[
           StartSel StopSel MaxFragments MaxWords MinWords ShortWord FragmentDelimiter HighlightAll
-        ].reduce({}) do |hash, key|
-          hash.tap do
-            value = indifferent_options[:highlight][key]
-
-            hash[key] = ts_headline_option_value(value)
-          end
+        ].to_h do |key|
+          [key, ts_headline_option_value(indifferent_options[:highlight][key])]
         end
       end
 
@@ -63,23 +59,20 @@ module PgSearch
 
         %w[
           start_sel stop_sel max_fragments max_words min_words short_word fragment_delimiter highlight_all
-        ].reduce({}) do |hash, deprecated_key|
-          hash.tap do
-            value = indifferent_options[:highlight][deprecated_key]
-
-            unless value.nil?
-              key = deprecated_key.camelize
-
-              warn(
-                "pg_search 3.0 will no longer accept :#{deprecated_key} as an argument to :ts_headline, " \
-                "use :#{key} instead.",
-                category: :deprecated,
-                uplevel: 1
-              )
-
-              hash[key] = ts_headline_option_value(value)
-            end
-          end
+        ].each_with_object({}) do |deprecated_key, hash|
+          value = indifferent_options[:highlight][deprecated_key]
+          next if value.nil?
+
+          key = deprecated_key.camelize
+
+          warn(
+            "pg_search 3.0 will no longer accept :#{deprecated_key} as an argument to :ts_headline, " \
+            "use :#{key} instead.",
+            category: :deprecated,
+            uplevel: 1
+          )
+
+          hash[key] = ts_headline_option_value(value)
         end
       end
 
@@ -96,8 +89,7 @@ module PgSearch
         end
       end
 
-      DISALLOWED_TSQUERY_CHARACTERS = /['?\\:‘’ʻʼ]/
-
+      DISALLOWED_TSQUERY_CHARACTERS = /['?\\:]/ # standard:disable Lint/UselessConstantScoping
       def tsquery_for_term(unsanitized_term)
         if options[:negation] && unsanitized_term.start_with?("!")
           unsanitized_term[0] = ""

data/lib/pg_search/model.rb

@@ -23,13 +23,14 @@ module PgSearch
 
       def multisearchable(options = {})
         include PgSearch::Multisearchable
+
         class_attribute :pg_search_multisearchable_options
         self.pg_search_multisearchable_options = options
       end
     end
 
-    def method_missing(symbol, *args)
-      case symbol
+    def method_missing(method, *, **)
+      case method
       when :pg_search_rank
         raise PgSearchRankNotSelected unless respond_to?(:pg_search_rank)
 
@@ -43,12 +44,9 @@ module PgSearch
       end
     end
 
-    def respond_to_missing?(symbol, *args)
-      case symbol
-      when :pg_search_rank
-        attributes.key?(:pg_search_rank)
-      when :pg_search_highlight
-        attributes.key?(:pg_search_highlight)
+    def respond_to_missing?(method, *, **)
+      if method.in?(%i[pg_search_rank pg_search_highlight])
+        attributes.key?(method)
       else
         super
       end

data/lib/pg_search/multisearch/rebuilder.rb

@@ -42,7 +42,7 @@ module PgSearch
       end
 
       def primary_key
-        model.primary_key
+        connection.quote_column_name(model.primary_key)
       end
 
       def rebuild_sql_template
@@ -68,9 +68,10 @@ module PgSearch
       def sti_clause
         clause = ""
         if model.column_names.include? model.inheritance_column
+          quoted_inheritance_column = connection.quote_column_name(model.inheritance_column)
           clause = "WHERE"
-          clause = "#{clause} #{model.inheritance_column} IS NULL OR" if model.base_class == model
-          clause = "#{clause} #{model.inheritance_column} = #{model_name}"
+          clause = "#{clause} #{quoted_inheritance_column} IS NULL OR" if model.base_class == model
+          clause = "#{clause} #{quoted_inheritance_column} = #{model_name}"
         end
         clause
       end

data/lib/pg_search/normalizer.rb

@@ -6,6 +6,8 @@ module PgSearch
       @config = config
     end
 
+    DISALLOWED_CHARACTERS = "'[''?\\:]'"
+
     def add_normalization(sql_expression)
       return sql_expression unless config.ignore.include?(:accents)
 
@@ -17,8 +19,16 @@ module PgSearch
       end
 
       Arel::Nodes::NamedFunction.new(
-        PgSearch.unaccent_function,
-        [sql_node]
+        "regexp_replace",
+        [
+          Arel::Nodes::NamedFunction.new(
+            PgSearch.unaccent_function,
+            [sql_node]
+          ),
+          Arel.sql(DISALLOWED_CHARACTERS),
+          Arel.sql("''"),
+          Arel.sql("'g'")
+        ]
       ).to_sql
     end
 

data/lib/pg_search/scope_options.rb

@@ -27,6 +27,7 @@ module PgSearch
       def self.[](tsearch)
         Module.new do
           include WithPgSearchHighlight
+
           define_method(:tsearch) { tsearch }
         end
       end
@@ -133,7 +134,7 @@ module PgSearch
       end
     end
 
-    FEATURE_CLASSES = {
+    FEATURE_CLASSES = { # standard:disable Lint/UselessConstantScoping
       dmetaphone: Features::DMetaphone,
       tsearch: Features::TSearch,
       trigram: Features::Trigram
@@ -163,11 +164,17 @@ module PgSearch
     end
 
     def rank_join(rank_table_alias)
-      "INNER JOIN (#{subquery.to_sql}) AS #{rank_table_alias} ON #{primary_key} = #{rank_table_alias}.pg_search_id"
+      arel_table = model.arel_table
+      subquery_arel = subquery.arel.as(rank_table_alias)
+
+      arel_table
+        .join(subquery_arel)
+        .on(arel_table[model.primary_key].eq(subquery_arel[:pg_search_id]))
+        .join_sources
     end
 
     def include_table_aliasing_for_rank(scope)
-      return scope if scope.included_modules.include?(PgSearchRankTableAliasing)
+      return scope if scope.include?(PgSearchRankTableAliasing)
 
       scope.all.spawn.tap do |new_scope|
         new_scope.instance_eval { extend PgSearchRankTableAliasing }

data/lib/pg_search/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PgSearch
-  VERSION = "2.3.7"
+  VERSION = "2.3.8"
 end

data/pg_search.gemspec

@@ -18,8 +18,8 @@ Gem::Specification.new do |s|
   s.files = `git ls-files -z`.split("\x0")
   s.require_paths = ["lib"]
 
-  s.add_dependency "activerecord", ">= 6.1"
-  s.add_dependency "activesupport", ">= 6.1"
+  s.add_dependency "activerecord", ">= 7.2"
+  s.add_dependency "activesupport", ">= 7.2"
 
-  s.required_ruby_version = ">= 3.0"
+  s.required_ruby_version = ">= 3.3"
 end

data/spec/integration/associations_spec.rb

@@ -20,6 +20,7 @@ describe "a pg_search_scope" do
 
         model do
           include PgSearch::Model
+
           belongs_to :another_model, class_name: "AssociatedModel"
 
           pg_search_scope :with_another, associated_against: {another_model: :title}
@@ -57,6 +58,7 @@ describe "a pg_search_scope" do
 
         model do
           include PgSearch::Model
+
           belongs_to :another_model, class_name: "AssociatedModel"
 
           pg_search_scope :with_associated, against: :title, associated_against: {another_model: :title}
@@ -93,6 +95,7 @@ describe "a pg_search_scope" do
 
         model do
           include PgSearch::Model
+
           has_many :other_models, class_name: "AssociatedModelWithHasMany", foreign_key: "ModelWithHasMany_id"
 
           pg_search_scope :with_associated, against: [:title], associated_against: {other_models: :title}
@@ -284,6 +287,7 @@ describe "a pg_search_scope" do
 
         model do
           include PgSearch::Model
+
           belongs_to :another_model, class_name: "AssociatedModel"
 
           pg_search_scope :with_associated, associated_against: {another_model: %i[title author]}
@@ -337,6 +341,7 @@ describe "a pg_search_scope" do
 
         model do
           include PgSearch::Model
+
           belongs_to :another_model, class_name: "AssociatedModel"
 
           pg_search_scope :with_associated, associated_against: {another_model: :number}
@@ -368,6 +373,7 @@ describe "a pg_search_scope" do
         model do
           has_many :children
           include PgSearch::Model
+
           pg_search_scope :search_name, against: :name
         end
       end
@@ -398,6 +404,8 @@ describe "a pg_search_scope" do
 
   context "when merging a pg_search_scope into another model's scope" do
     with_model :ModelWithAssociation do
+      table
+
       model do
         has_many :associated_models
       end
@@ -411,6 +419,7 @@ describe "a pg_search_scope" do
 
       model do
         include PgSearch::Model
+
         belongs_to :model_with_association
 
         pg_search_scope :search_content, against: :content
@@ -444,6 +453,8 @@ describe "a pg_search_scope" do
 
   context "when chained onto a has_many association" do
     with_model :Company do
+      table
+
       model do
         has_many :positions
       end
@@ -457,6 +468,7 @@ describe "a pg_search_scope" do
 
       model do
         include PgSearch::Model
+
         pg_search_scope :search, against: :title, using: %i[tsearch trigram]
       end
     end

data/spec/integration/deprecation_spec.rb

@@ -5,6 +5,8 @@ require "active_support/core_ext/kernel/reporting"
 
 describe "Including the deprecated PgSearch module" do
   with_model :SomeModel do
+    table
+
     model do
       silence_warnings do
         include PgSearch
@@ -12,7 +14,9 @@ describe "Including the deprecated PgSearch module" do
     end
   end
 
-  with_model :AnotherModel
+  with_model :AnotherModel do
+    table
+  end
 
   it "includes PgSearch::Model" do
     expect(SomeModel.ancestors).to include PgSearch::Model

data/spec/integration/pagination_spec.rb

@@ -11,6 +11,7 @@ describe "pagination" do
 
       model do
         include PgSearch::Model
+
         pg_search_scope :search_name, against: :name
 
         def self.page(page_number)

data/spec/integration/pg_search_spec.rb

@@ -14,6 +14,7 @@ describe "an Active Record model which includes PgSearch" do
 
     model do
       include PgSearch::Model
+
       belongs_to :parent_model
     end
   end
@@ -24,6 +25,7 @@ describe "an Active Record model which includes PgSearch" do
 
     model do
       include PgSearch::Model
+
       has_many :models_with_pg_search
       scope :active, -> { where(active: true) }
     end
@@ -238,6 +240,7 @@ describe "an Active Record model which includes PgSearch" do
 
           model do
             include PgSearch::Model
+
             belongs_to :person
             pg_search_scope :search_city, against: [:city]
           end
@@ -250,6 +253,7 @@ describe "an Active Record model which includes PgSearch" do
 
           model do
             include PgSearch::Model
+
             has_many :houses
             pg_search_scope :named, against: [:name]
             scope :with_house_in_city, lambda { |city|
@@ -1046,6 +1050,7 @@ describe "an Active Record model which includes PgSearch" do
 
         model do
           include PgSearch::Model
+
           has_many :comments
         end
       end
@@ -1083,10 +1088,34 @@ describe "an Active Record model which includes PgSearch" do
       it "finds by a combination of the two" do
         expect(Post.search_by_content_with_tsvector("phooey commentone").map(&:id)).to eq([expected.id])
       end
+
+      it "finds by the tsvector column when ordering by an associated table" do
+        # Reference the physical table name that Active Record would normally
+        # leave unaliased. The old string rank join made AliasTracker think the
+        # name was already used and alias this outer join, breaking the order.
+        # https://github.com/Casecommons/pg_search/issues/206
+        results = Post
+          .joins(:comments)
+          .search_by_content_with_tsvector("phooey")
+          .order(Comment.table_name => {id: :asc})
+
+        expect(results).to eq([expected])
+      end
+
+      it "finds by the tsvector column when ordering by an association alias" do
+        results = Post
+          .joins(:comments)
+          .search_by_content_with_tsvector("phooey")
+          .order(comments: {id: :asc})
+
+        expect(results).to eq([expected])
+      end
     end
 
     context "when using multiple tsvector columns" do
       with_model :ModelWithTsvector do
+        table
+
         model do
           include PgSearch::Model
 
@@ -1185,7 +1214,7 @@ describe "an Active Record model which includes PgSearch" do
       end
 
       context "when the query includes accents" do
-        let(:term) { "L#{%w[‘ ’ ʻ ʼ].sample}Content" }
+        let(:term) { "L#{%w[‘ ’ ʻ ʼ ʹ ʽ ˈ ＇ ʼn].sample}Content" }
         let(:included) { ModelWithPgSearch.create!(title: "Weird #{term}") }
         let(:results) { ModelWithPgSearch.search_title_without_accents(term) }
 

data/spec/integration/single_table_inheritance_spec.rb

@@ -12,6 +12,7 @@ describe "a pg_search_scope on an STI subclass" do
 
       model do
         include PgSearch::Model
+
         pg_search_scope :search_content, against: :content
       end
     end
@@ -52,6 +53,7 @@ describe "a pg_search_scope on an STI subclass" do
 
       model do
         include PgSearch::Model
+
         self.inheritance_column = "custom_type"
         pg_search_scope :search_content, against: :content
       end

data/spec/lib/pg_search/configuration/association_spec.rb

@@ -19,6 +19,7 @@ describe PgSearch::Configuration::Association do
 
     model do
       include PgSearch::Model
+
       has_one :avatar, class_name: "Avatar"
       belongs_to :site
 
@@ -34,6 +35,7 @@ describe PgSearch::Configuration::Association do
 
     model do
       include PgSearch::Model
+
       has_many :users, class_name: "User"
 
       pg_search_scope :with_users, associated_against: {users: :name}

data/spec/lib/pg_search/configuration/foreign_column_spec.rb

@@ -18,6 +18,7 @@ describe PgSearch::Configuration::ForeignColumn do
 
       model do
         include PgSearch::Model
+
         belongs_to :another_model, class_name: "AssociatedModel"
 
         pg_search_scope :with_another, associated_against: {another_model: :title}

data/spec/lib/pg_search/features/trigram_spec.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "spec_helper"
-require "ostruct"
 
 # standard:disable RSpec/MultipleMemoizedHelpers, RSpec/NestedGroups
 describe PgSearch::Features::Trigram do
@@ -16,7 +15,8 @@ describe PgSearch::Features::Trigram do
     ]
   }
   let(:normalizer) { PgSearch::Normalizer.new(config) }
-  let(:config) { OpenStruct.new(ignore: []) }
+  let(:config) { instance_double(PgSearch::Configuration, ignore: ignore) }
+  let(:ignore) { [] }
 
   let(:coalesced_columns) do
     <<~SQL.squish
@@ -35,7 +35,6 @@ describe PgSearch::Features::Trigram do
 
   describe "conditions" do
     it "escapes the search document and query" do
-      config.ignore = []
       expect(feature.conditions.to_sql).to eq("('#{query}' % (#{coalesced_columns}))")
     end
 
@@ -45,15 +44,15 @@ describe PgSearch::Features::Trigram do
       end
 
       it 'uses the "<%" operator when searching by word_similarity' do
-        config.ignore = []
         expect(feature.conditions.to_sql).to eq("('#{query}' <% (#{coalesced_columns}))")
       end
     end
 
     context "when ignoring accents" do
+      let(:ignore) { [:accents] }
+
       it "escapes the search document and query, but not the accent function" do
-        config.ignore = [:accents]
-        expect(feature.conditions.to_sql).to eq("(unaccent('#{query}') % (unaccent(#{coalesced_columns})))")
+        expect(feature.conditions.to_sql).to eq("(regexp_replace(unaccent('#{query}'), '[''?\\:]', '', 'g') % (regexp_replace(unaccent(#{coalesced_columns}), '[''?\\:]', '', 'g')))")
       end
     end
 

data/spec/lib/pg_search/multisearch/rebuilder_spec.rb

@@ -7,7 +7,9 @@ describe PgSearch::Multisearch::Rebuilder do
   with_table "pg_search_documents", &DOCUMENTS_SCHEMA
 
   describe "when initialized with a model that is not multisearchable" do
-    with_model :not_multisearchable
+    with_model :not_multisearchable do
+      table
+    end
 
     it "raises an exception" do
       expect {
@@ -23,8 +25,11 @@ describe PgSearch::Multisearch::Rebuilder do
     context "when the model defines .rebuild_pg_search_documents" do
       context "when multisearchable is not conditional" do
         with_model :Model do
+          table
+
           model do
             include PgSearch::Model
+
             multisearchable
 
             def rebuild_pg_search_documents
@@ -53,6 +58,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
               model do
                 include PgSearch::Model
+
                 multisearchable conditional_key => :active?
 
                 def rebuild_pg_search_documents
@@ -84,6 +90,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
             model do
               include PgSearch::Model
+
               multisearchable against: :name
             end
           end
@@ -116,7 +123,7 @@ describe PgSearch::Multisearch::Rebuilder do
             expected_sql = <<~SQL.squish
               INSERT INTO "pg_search_documents" (searchable_type, searchable_id, content, created_at, updated_at)
                 SELECT 'Model' AS searchable_type,
-                       #{Model.quoted_table_name}.#{Model.primary_key} AS searchable_id,
+                       #{Model.quoted_table_name}.#{Model.connection.quote_column_name(Model.primary_key)} AS searchable_id,
                        (
                          coalesce(#{Model.quoted_table_name}."name"::text, '')
                        ) AS content,
@@ -147,6 +154,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
               model do
                 include PgSearch::Model
+
                 multisearchable against: :name
               end
             end
@@ -166,6 +174,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
               model do
                 include PgSearch::Model
+
                 multisearchable against: :name
               end
             end
@@ -178,7 +187,7 @@ describe PgSearch::Multisearch::Rebuilder do
               expected_sql = <<~SQL.squish
                 INSERT INTO "pg_search_documents" (searchable_type, searchable_id, content, created_at, updated_at)
                   SELECT 'ModelWithNonStandardPrimaryKey' AS searchable_type,
-                         #{ModelWithNonStandardPrimaryKey.quoted_table_name}.non_standard_primary_key AS searchable_id,
+                         #{ModelWithNonStandardPrimaryKey.quoted_table_name}."non_standard_primary_key" AS searchable_id,
                          (
                            coalesce(#{ModelWithNonStandardPrimaryKey.quoted_table_name}."name"::text, '')
                          ) AS content,
@@ -205,8 +214,11 @@ describe PgSearch::Multisearch::Rebuilder do
 
         context "when :against includes non-column dynamic methods" do
           with_model :Model do
+            table
+
             model do
               include PgSearch::Model
+
               multisearchable against: [:foo]
 
               def foo
@@ -244,6 +256,41 @@ describe PgSearch::Multisearch::Rebuilder do
           # standard:enable RSpec/ExampleLength
         end
 
+        context "with an identifier that requires quoting" do
+          with_model :Model do
+            table do |t|
+              t.string :name
+            end
+
+            model do
+              include PgSearch::Model
+
+              multisearchable against: :name
+            end
+          end
+
+          it "quotes the primary key in the generated SQL" do
+            malicious_pk = %(id"; DROP TABLE pg_search_documents; --)
+            allow(Model).to receive(:primary_key).and_return(malicious_pk)
+
+            rebuilder = described_class.new(Model)
+            sql = rebuilder.send(:rebuild_sql)
+
+            expect(sql).to include(Model.connection.quote_column_name(malicious_pk))
+          end
+
+          it "quotes the inheritance column in the STI clause" do
+            malicious_column = %(type"; DROP TABLE pg_search_documents; --)
+            allow(Model).to receive(:inheritance_column).and_return(malicious_column)
+            allow(Model).to receive(:column_names).and_return(Model.column_names + [malicious_column])
+
+            rebuilder = described_class.new(Model)
+            sql = rebuilder.send(:rebuild_sql)
+
+            expect(sql).to include(Model.connection.quote_column_name(malicious_column))
+          end
+        end
+
         context "when only additional_attributes is set" do
           with_model :Model do
             table do |t|
@@ -252,6 +299,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
             model do
               include PgSearch::Model
+
               multisearchable against: :name,
                 additional_attributes: ->(obj) { {additional_attribute_column: "#{obj.class}::#{obj.id}"} }
             end
@@ -281,6 +329,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
             model do
               include PgSearch::Model
+
               multisearchable if: :active?
             end
           end
@@ -322,6 +371,7 @@ describe PgSearch::Multisearch::Rebuilder do
 
             model do
               include PgSearch::Model
+
               multisearchable unless: :inactive?
             end
           end

data/spec/lib/pg_search/multisearch_spec.rb

@@ -148,7 +148,7 @@ describe PgSearch::Multisearch do
           expected_sql = <<~SQL.squish
             INSERT INTO #{PgSearch::Document.quoted_table_name} (searchable_type, searchable_id, content, created_at, updated_at)
               SELECT #{connection.quote(model.name)} AS searchable_type,
-                     #{model.quoted_table_name}.id AS searchable_id,
+                     #{model.quoted_table_name}.#{connection.quote_column_name(model.primary_key)} AS searchable_id,
                      (
                        coalesce(#{model.quoted_table_name}."title"::text, '')
                      ) AS content,
@@ -175,7 +175,7 @@ describe PgSearch::Multisearch do
           expected_sql = <<~SQL.squish
             INSERT INTO #{PgSearch::Document.quoted_table_name} (searchable_type, searchable_id, content, created_at, updated_at)
               SELECT #{connection.quote(model.name)} AS searchable_type,
-                     #{model.quoted_table_name}.id AS searchable_id,
+                     #{model.quoted_table_name}.#{connection.quote_column_name(model.primary_key)} AS searchable_id,
                      (
                        coalesce(#{model.quoted_table_name}."title"::text, '') || ' ' || coalesce(#{model.quoted_table_name}."content"::text, '')
                      ) AS content,