ransack 4.4.0 → 4.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4fe4a128cacdb920f2efe5fc5063cd21b8fa1a4a527fa07e84123f2ead7a6694
-  data.tar.gz: 82f66ffeaa4d8bed52614374fe71617bb1c2d85ac1745dfca7e4520e07782545
+  metadata.gz: a52d7bb9b56c22ac02c1d90db283a7b13b0edc867ffae33d6feacb27189ab289
+  data.tar.gz: d28faf9e61c695c770850bde4079e924fc60eb92c1aebdaa02978ae1e9569724
 SHA512:
-  metadata.gz: a80ce4b0da981c6e3b2d18de8c742d3598a2a7479b44d04adaa1ce3c60a81fa4377f706c78048c1d72f719d488afd379c303b55811053d8613eb82cf0f0dfcad
-  data.tar.gz: cd3f836f63aa19596a3510961bbe64a1f9abcc858473bf9516623e5fe76908bcbb346d36cf1cd7cb83094f0a3c0f4bcdb942b0e137a9020cd8772e28d01d9f51
+  metadata.gz: '03959260e88ddaa46d84c6283568fdf0990daf94770db22dc6d9d3fe2ac4735d13d913dae4b02850b885409bc431a420fa53f45299a090d21f9d6330616585fe'
+  data.tar.gz: 3be3468251890fb9be19ab4941d4de0cadf0071f9e561efae9f8727c52ae6216f3b20e18bc2853e516c5c43a4c2a0a6425182ebf9e39fed50e1f6deaf3d1c6e6

data/README.md

@@ -13,7 +13,7 @@ There are advanced searching solutions around, like ElasticSearch or Algolia. **
 
 Ready to move beyond the basics? Use **advanced features** like i18n and extensive configuration options.
 
-Ransack is supported for Rails 8.0, 7.2, 7.1 on Ruby 3.1 and later.
+Ransack is supported for Rails 8.0, 7.2 on Ruby 3.1 and later.
 
 ## Installation
 
@@ -41,7 +41,7 @@ This [gist](https://gist.github.com/raghubetina/d5fc3df67ddbadcac271) has a quic
 
 * Before filing an issue, please read the [Contributing Guide](CONTRIBUTING.md).
 * File an issue if a bug is caused by Ransack, is new (has not already been reported), and _can be reproduced from the information you provide_.
-* Please consider adding a branch with a failing spec describing the problem.
+* Please consider creating a pull request with a failing test that demonstrates the problem.
 * Contributions are welcome. :smiley:
 * Please do not use the issue tracker for personal support requests. Stack Overflow or [GitHub Discussions](https://github.com/activerecord-hackery/ransack/discussions) is a better place for that where a wider community can help you!
 

data/lib/ransack/nodes/condition.rb

@@ -226,7 +226,7 @@ module Ransack
       end
 
       def casted_values_for_attribute(attr)
-        validated_values.map(&:cast_array)
+        validated_values.map { |v| v.cast(predicate.type || attr.type) }
       end
 
       def formatted_values_for_attribute(attr)

data/lib/ransack/nodes/value.rb

@@ -43,14 +43,6 @@ module Ransack
         end
       end
 
-      def cast_array
-        if value.is_a?(Array)
-          cast_to_date(value)
-        else
-          value
-        end
-      end
-
       def cast_to_date(val)
         if val.respond_to?(:to_date)
           val.to_date rescue nil

data/lib/ransack/search.rb

@@ -160,19 +160,31 @@ module Ransack
       end
     end
 
+    # The largest position a multiparameter key (`created_at(1i)`) may carry.
+    # Rails' date and time selects emit at most six, year to second. The
+    # position indexes an array, so an unbounded one from a crafted query
+    # string would allocate an array that size (GHSA-vxc9-rm8f-p56j).
+    MULTIPARAMETER_POSITION_LIMIT = 16
+
+    # Folds `created_at(1i)`, `created_at(2i)`, ... into `created_at` as an
+    # array of cast values, the way Active Record does for form input. The
+    # keys are untrusted, so a malformed one is dropped rather than raised
+    # on: no position (`created_at(`), a position outside 1 to the limit,
+    # or a fragment for an attribute that was also given as a plain value.
     def collapse_multiparameter_attributes!(attrs)
       attrs.keys.each do |k|
         if k.include?(Constants::LEFT_PARENTHESIS)
           real_attribute, position = k.split(/\(|\)/)
-          cast =
-          if Constants::A_S_I.include?(position.last)
-            position.last
-          else
-            nil
-          end
-          position = position.to_i - 1
           value = attrs.delete(k)
+          next if position.nil?
+
+          cast = Constants::A_S_I.include?(position.last) ? position.last : nil
+          position = position.to_i - 1
+          next if position < 0 || position >= MULTIPARAMETER_POSITION_LIMIT
+
           attrs[real_attribute] ||= []
+          next unless attrs[real_attribute].is_a?(Array)
+
           attrs[real_attribute][position] =
           if cast
             if value.blank? && cast == Constants::I

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '4.4.0'
+  VERSION = '4.4.2'
 end

data/lib/ransack.rb

@@ -1,10 +1,6 @@
 require 'active_support/dependencies/autoload'
 require 'active_support/deprecation'
-require 'active_support/version'
-
-if ::ActiveSupport.version >= ::Gem::Version.new("7.1")
-  require 'active_support/deprecator'
-end
+require 'active_support/deprecator'
 
 require 'active_support/core_ext'
 require 'ransack/configuration'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 4.4.0
+  version: 4.4.2
 platform: ruby
 authors:
 - Ernie Miller
@@ -11,7 +11,7 @@ authors:
 - David Rodríguez
 bindir: bin
 cert_chain: []
-date: 2025-09-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -19,28 +19,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
 - !ruby/object:Gem::Dependency
   name: i18n
   requirement: !ruby/object:Gem::Requirement
@@ -130,32 +130,6 @@ files:
 - lib/ransack/translate.rb
 - lib/ransack/version.rb
 - lib/ransack/visitor.rb
-- spec/blueprints/articles.rb
-- spec/blueprints/comments.rb
-- spec/blueprints/notes.rb
-- spec/blueprints/people.rb
-- spec/blueprints/tags.rb
-- spec/console.rb
-- spec/helpers/polyamorous_helper.rb
-- spec/helpers/ransack_helper.rb
-- spec/polyamorous/activerecord_compatibility_spec.rb
-- spec/polyamorous/join_association_spec.rb
-- spec/polyamorous/join_dependency_spec.rb
-- spec/polyamorous/join_spec.rb
-- spec/ransack/adapters/active_record/base_spec.rb
-- spec/ransack/adapters/active_record/context_spec.rb
-- spec/ransack/configuration_spec.rb
-- spec/ransack/helpers/form_builder_spec.rb
-- spec/ransack/helpers/form_helper_spec.rb
-- spec/ransack/nodes/condition_spec.rb
-- spec/ransack/nodes/grouping_spec.rb
-- spec/ransack/nodes/value_spec.rb
-- spec/ransack/predicate_spec.rb
-- spec/ransack/search_spec.rb
-- spec/ransack/translate_spec.rb
-- spec/spec_helper.rb
-- spec/support/en.yml
-- spec/support/schema.rb
 homepage: https://github.com/activerecord-hackery/ransack
 licenses:
 - MIT
@@ -168,40 +142,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Object-based searching for Active Record.
-test_files:
-- spec/blueprints/articles.rb
-- spec/blueprints/comments.rb
-- spec/blueprints/notes.rb
-- spec/blueprints/people.rb
-- spec/blueprints/tags.rb
-- spec/console.rb
-- spec/helpers/polyamorous_helper.rb
-- spec/helpers/ransack_helper.rb
-- spec/polyamorous/activerecord_compatibility_spec.rb
-- spec/polyamorous/join_association_spec.rb
-- spec/polyamorous/join_dependency_spec.rb
-- spec/polyamorous/join_spec.rb
-- spec/ransack/adapters/active_record/base_spec.rb
-- spec/ransack/adapters/active_record/context_spec.rb
-- spec/ransack/configuration_spec.rb
-- spec/ransack/helpers/form_builder_spec.rb
-- spec/ransack/helpers/form_helper_spec.rb
-- spec/ransack/nodes/condition_spec.rb
-- spec/ransack/nodes/grouping_spec.rb
-- spec/ransack/nodes/value_spec.rb
-- spec/ransack/predicate_spec.rb
-- spec/ransack/search_spec.rb
-- spec/ransack/translate_spec.rb
-- spec/spec_helper.rb
-- spec/support/en.yml
-- spec/support/schema.rb
+test_files: []

data/spec/blueprints/articles.rb

@@ -1,5 +0,0 @@
-Article.blueprint do
-  person
-  title
-  body
-end

data/spec/blueprints/comments.rb

@@ -1,5 +0,0 @@
-Comment.blueprint do
-  article
-  person
-  body
-end

data/spec/blueprints/notes.rb

@@ -1,5 +0,0 @@
-Note.blueprint do
-  note
-  notable_type { "Article" }
-  notable_id
-end

data/spec/blueprints/people.rb

@@ -1,8 +0,0 @@
-Person.blueprint do
-  name
-  email { "test@example.com" }
-  salary
-  only_sort
-  only_search
-  only_admin
-end

data/spec/blueprints/tags.rb

@@ -1,3 +0,0 @@
-Tag.blueprint do
-  name    { Sham.tag_name }
-end

data/spec/console.rb

@@ -1,25 +0,0 @@
-Bundler.setup
-require 'machinist/active_record'
-require 'sham'
-require 'faker'
-require 'ransack'
-
-Dir[File.expand_path('../../spec/{helpers,support,blueprints}/*.rb', __FILE__)]
-.each do |f|
-  require f
-end
-
-Sham.define do
-  name     { Faker::Name.name }
-  title    { Faker::Lorem.sentence }
-  body     { Faker::Lorem.paragraph }
-  salary   { |index| 30000 + (index * 1000) }
-  tag_name { Faker::Lorem.words(number: 3).join(' ') }
-  note     { Faker::Lorem.words(number: 7).join(' ') }
-  only_admin  { Faker::Lorem.words(number: 3).join(' ') }
-  only_search { Faker::Lorem.words(number: 3).join(' ') }
-  only_sort   { Faker::Lorem.words(number: 3).join(' ') }
-  notable_id  { |id| id }
-end
-
-Schema.create

data/spec/helpers/polyamorous_helper.rb

@@ -1,13 +0,0 @@
-module PolyamorousHelper
-  def new_join_association(reflection, children, klass)
-    Polyamorous::JoinAssociation.new reflection, children, klass
-  end
-
-  def new_join_dependency(klass, associations = {})
-    Polyamorous::JoinDependency.new klass, klass.arel_table, associations, Polyamorous::InnerJoin
-  end
-
-  def new_join(name, type = Polyamorous::InnerJoin, klass = nil)
-    Polyamorous::Join.new name, type, klass
-  end
-end

data/spec/helpers/ransack_helper.rb

@@ -1,9 +0,0 @@
-module RansackHelper
-  def quote_table_name(table)
-    ActiveRecord::Base.connection.quote_table_name(table)
-  end
-
-  def quote_column_name(column)
-    ActiveRecord::Base.connection.quote_column_name(column)
-  end
-end

data/spec/polyamorous/activerecord_compatibility_spec.rb

@@ -1,15 +0,0 @@
-require 'spec_helper'
-
-module Polyamorous
-  describe "ActiveRecord Compatibility" do
-    it 'works with self joins and includes' do
-      trade_account = Account.create!
-      Account.create!(trade_account: trade_account)
-
-      accounts = Account.joins(:trade_account).includes(:trade_account, :agent_account)
-      account = accounts.first
-
-      expect(account.agent_account).to be_nil
-    end
-  end
-end

data/spec/polyamorous/join_association_spec.rb

@@ -1,29 +0,0 @@
-require 'spec_helper'
-
-module Polyamorous
-  describe JoinAssociation do
-    let(:join_dependency) { new_join_dependency Note, {} }
-    let(:reflection) { Note.reflect_on_association(:notable) }
-    let(:parent) { join_dependency.send(:join_root) }
-    let(:join_association) {
-      new_join_association(reflection, parent.children, Article)
-    }
-
-    subject { new_join_association(reflection, parent.children, Person) }
-
-    it 'leaves the original reflection intact for thread safety' do
-      reflection.instance_variable_set(:@klass, Article)
-      join_association
-      .swapping_reflection_klass(reflection, Person) do |new_reflection|
-        expect(new_reflection.options).not_to equal reflection.options
-        expect(new_reflection.options).not_to have_key(:polymorphic)
-        expect(new_reflection.klass).to eq(Person)
-        expect(reflection.klass).to eq(Article)
-      end
-    end
-
-    it 'sets the polymorphic option to true after initializing' do
-      expect(join_association.reflection.options[:polymorphic]).to be true
-    end
-  end
-end

data/spec/polyamorous/join_dependency_spec.rb

@@ -1,80 +0,0 @@
-require 'spec_helper'
-
-module Polyamorous
-  describe JoinDependency do
-    context 'with symbol joins' do
-      subject { new_join_dependency Person, articles: :comments }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq(2) }
-      specify { expect(subject.send(:join_root).drop(1).map(&:join_type).uniq)
-        .to eq [Polyamorous::InnerJoin] }
-    end
-
-    context 'with has_many :through association' do
-      subject { new_join_dependency Person, :authored_article_comments }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq 1 }
-      specify { expect(subject.send(:join_root).drop(1).first.table_name)
-        .to eq 'comments' }
-    end
-
-    context 'with outer join' do
-      subject { new_join_dependency Person, new_join(:articles, :outer) }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq 1 }
-      specify { expect(subject.send(:join_root).drop(1).first.join_type)
-        .to eq Polyamorous::OuterJoin }
-    end
-
-    context 'with nested outer joins' do
-      subject { new_join_dependency Person,
-        new_join(:articles, :outer) => new_join(:comments, :outer) }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq 2 }
-      specify { expect(subject.send(:join_root).drop(1).map(&:join_type))
-        .to eq [Polyamorous::OuterJoin, Polyamorous::OuterJoin] }
-      specify { expect(subject.send(:join_root).drop(1).map(&:join_type).uniq)
-        .to eq [Polyamorous::OuterJoin] }
-    end
-
-    context 'with polymorphic belongs_to join' do
-      subject { new_join_dependency Note, new_join(:notable, :inner, Person) }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq 1 }
-      specify { expect(subject.send(:join_root).drop(1).first.join_type)
-        .to eq Polyamorous::InnerJoin }
-      specify { expect(subject.send(:join_root).drop(1).first.table_name)
-        .to eq 'people' }
-    end
-
-    context 'with polymorphic belongs_to join and nested symbol join' do
-      subject { new_join_dependency Note,
-        new_join(:notable, :inner, Person) => :comments }
-
-      specify { expect(subject.send(:join_root).drop(1).size)
-        .to eq 2 }
-      specify { expect(subject.send(:join_root).drop(1).map(&:join_type).uniq)
-        .to eq [Polyamorous::InnerJoin] }
-      specify { expect(subject.send(:join_root).drop(1).first.table_name)
-        .to eq 'people' }
-      specify { expect(subject.send(:join_root).drop(1)[1].table_name)
-        .to eq 'comments' }
-    end
-
-    context 'with polymorphic belongs_to join and nested join' do
-      subject { new_join_dependency Note,
-        new_join(:notable, :outer, Person) => :comments }
-      specify { expect(subject.send(:join_root).drop(1).size).to eq 2 }
-      specify { expect(subject.send(:join_root).drop(1).map(&:join_type)).to eq [Polyamorous::OuterJoin, Polyamorous::InnerJoin] }
-      specify { expect(subject.send(:join_root).drop(1).first.table_name)
-        .to eq 'people' }
-      specify { expect(subject.send(:join_root).drop(1)[1].table_name)
-        .to eq 'comments' }
-    end
-  end
-end

data/spec/polyamorous/join_spec.rb

@@ -1,19 +0,0 @@
-require 'spec_helper'
-
-module Polyamorous
-  describe Join do
-    it 'is a tree node' do
-      join = new_join(:articles, :outer)
-      expect(join).to be_kind_of(TreeNode)
-    end
-
-    it 'can be added to a tree' do
-      join = new_join(:articles, :outer)
-
-      tree_hash = {}
-      join.add_to_tree(tree_hash)
-
-      expect(tree_hash[join]).to be {}
-    end
-  end
-end