ransack 4.4.3 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4de514e3bd66dcd465c8253260a52e8fa9e40476a6e1d12b09dae4ed1ec8aaaf
-  data.tar.gz: 2f156ce6c2bde6adca76eec24e59cf625e2e53b6922d5a0de370d7a1be75354c
+  metadata.gz: 0251527dc22cca8cb55ff672b598d74fef0ec4c2b1c6336cb0b8d52d69dabafc
+  data.tar.gz: fd218c05d4697cca5b9a8b4111af7a5fa4ddc559071e9a3194aca2f2b2da6c9d
 SHA512:
-  metadata.gz: f4c4983ce0a10d9afc2f538666f98eeee0eb8f9da168fcd30800ded495cff71807d456e1c462530866d7e5c7954a737fd7127f3badcdb511d48bc9eab22b5d89
-  data.tar.gz: 83403fc8e6cfce559597fa844e0ff79b45623dfd285382a2d0d84547263bd8c95f59998c226b7bd5b4c4745e6d70ddf45c6d5e1fd75c9b7278ae4b09592ef150
+  metadata.gz: bc524a7f9a4fac90d6f2e3b9818ccf76bab0f44c872c33db043f049f759f2641c03b338c2cfa28c70a20f6d1d2c4569390e43ec9e5da9daf2537002c519ad3fc
+  data.tar.gz: 3a599c3c9472f0033976ed0301cc0545b62711cccb36817db373c0f19ba0b828640a89bc3784b533346633112fb017353c63c490fa792b3eb3e7aea82f41e527

data/README.md

@@ -2,6 +2,7 @@
 
 [![Build Status](https://github.com/activerecord-hackery/ransack/workflows/test/badge.svg)](https://github.com/activerecord-hackery/ransack/actions)
 [![Gem Version](https://badge.fury.io/rb/ransack.svg)](http://badge.fury.io/rb/ransack)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/activerecord-hackery/ransack)
 [![Code Climate](https://codeclimate.com/github/activerecord-hackery/ransack/badges/gpa.svg)](https://codeclimate.com/github/activerecord-hackery/ransack)
 [![Backers on Open Collective](https://opencollective.com/ransack/backers/badge.svg)](#backers) [![Sponsors on Open Collective](https://opencollective.com/ransack/sponsors/badge.svg)](#sponsors)
 
@@ -13,7 +14,7 @@ There are advanced searching solutions around, like ElasticSearch or Algolia. **
 
 Ready to move beyond the basics? Use **advanced features** like i18n and extensive configuration options.
 
-Ransack is supported for Rails 8.0, 7.2 on Ruby 3.1 and later.
+Ransack is supported for Rails 8.1, 8.0, 7.2 on Ruby 3.1 and later.
 
 ## Installation
 

data/lib/ransack/adapters/active_record/context.rb

@@ -15,7 +15,7 @@ module Ransack
           relation     = attr.arel_attribute.relation
           name         = attr.arel_attribute.name.to_s
           table        = relation.respond_to?(:table_name) ? relation.table_name : relation.name
-          schema_cache = self.klass.connection.schema_cache
+          schema_cache = self.klass.connection_pool.schema_cache
           unless schema_cache.send(:data_source_exists?, table)
             raise "No table named #{table} exists."
           end
@@ -44,15 +44,15 @@ module Ransack
               if scope_or_sort.is_a?(Symbol)
                 relation = relation.send(scope_or_sort)
               else
-                case Ransack.options[:postgres_fields_sort_option]
+                case Ransack.options[:fields_sort_option]
                 when :nulls_first
-                  scope_or_sort = scope_or_sort.direction == :asc ? Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST") : Arel.sql("#{scope_or_sort.to_sql} NULLS LAST")
+                  scope_or_sort = scope_or_sort.direction == :asc ? scope_or_sort.nulls_first : scope_or_sort.nulls_last
                 when :nulls_last
-                  scope_or_sort = scope_or_sort.direction == :asc ? Arel.sql("#{scope_or_sort.to_sql} NULLS LAST") : Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST")
+                  scope_or_sort = scope_or_sort.direction == :asc ? scope_or_sort.nulls_last : scope_or_sort.nulls_first
                 when :nulls_always_first
-                  scope_or_sort = Arel.sql("#{scope_or_sort.to_sql} NULLS FIRST")
+                  scope_or_sort = scope_or_sort.nulls_first
                 when :nulls_always_last
-                  scope_or_sort = Arel.sql("#{scope_or_sort.to_sql} NULLS LAST")
+                  scope_or_sort = scope_or_sort.nulls_last
                 end
 
                 relation = relation.order(scope_or_sort)
@@ -64,10 +64,9 @@ module Ransack
         end
 
         def attribute_method?(str, klass = @klass)
-          return false unless key_within_depth_limit?(str)
-
           exists = false
-          if ransackable_attribute?(str, klass)
+          if ransackable_attribute?(str, klass) ||
+             ransortable_attribute?(str, klass)
             exists = true
           elsif (segments = str.split(Constants::UNDERSCORE)).size > 1
             remainder = []
@@ -214,9 +213,9 @@ module Ransack
             end
           when Arel::Nodes::Equality
             pk = primary_key
-            if join_root.left == pk
+            if join_root.left.eql?(pk)
               join_root.right
-            elsif join_root.right == pk
+            elsif join_root.right.eql?(pk)
               join_root.left
             else
               nil
@@ -239,11 +238,10 @@ module Ransack
         end
 
         def get_parent_and_attribute_name(str, parent = @base)
-          return [parent, nil] unless key_within_depth_limit?(str)
-
           attr_name = nil
 
-          if ransackable_attribute?(str, klassify(parent))
+          if ransackable_attribute?(str, klassify(parent)) ||
+             ransortable_attribute?(str, klassify(parent))
             attr_name = str
           elsif (segments = str.split(Constants::UNDERSCORE)).size > 1
             remainder = []

data/lib/ransack/configuration.rb

@@ -34,8 +34,9 @@ module Ransack
       down_arrow: '▲'.freeze,
       default_arrow: nil,
       sanitize_scope_args: true,
-      postgres_fields_sort_option: nil,
-      strip_whitespace: true
+      fields_sort_option: nil,
+      strip_whitespace: true,
+      ignore_blank_values: true
     }
 
     def configure
@@ -162,13 +163,24 @@ module Ransack
     # User may want to configure it like this:
     #
     # Ransack.configure do |c|
-    #   c.postgres_fields_sort_option = :nulls_first # or e.g. :nulls_always_last
+    #   c.fields_sort_option = :nulls_first # or e.g. :nulls_always_last
     # end
     #
-    # See this feature: https://www.postgresql.org/docs/13/queries-order.html
+    # Emitted through Arel's `nulls_first` / `nulls_last`, so it works on any
+    # backend Arel supports it for. MySQL has no NULLS FIRST / LAST syntax and
+    # Arel does not emulate it, so this option does not apply there.
     #
+    # See https://www.postgresql.org/docs/current/queries-order.html
+    #
+    def fields_sort_option=(setting)
+      self.options[:fields_sort_option] = setting
+    end
+
+    # Renamed to `fields_sort_option` now that NULLS FIRST / NULLS LAST is
+    # emitted through Arel and is no longer PostgreSQL-specific. The old name
+    # still works so existing initializers keep running.
     def postgres_fields_sort_option=(setting)
-      self.options[:postgres_fields_sort_option] = setting
+      self.fields_sort_option = setting
     end
 
     # By default, Ransack displays sort order indicator arrows in sort links.
@@ -197,6 +209,27 @@ module Ransack
       self.options[:strip_whitespace] = boolean
     end
 
+    # By default, Ransack ignores search conditions whose value is blank — an
+    # empty string, or an array containing only blank values. This is what makes
+    # a search form submitted with empty fields return every record rather than
+    # none, and it is almost always what an HTML form wants.
+    #
+    # Set this to false to treat a blank value as a value to search *for*:
+    # `name_eq: ''` then generates `WHERE name = ''`, and `id_in: []` generates a
+    # condition matching nothing rather than being dropped. This is usually what
+    # a JSON API wants, where an empty value is an explicit filter rather than an
+    # untouched form field.
+    #
+    # A `nil` value is ignored either way.
+    #
+    # Ransack.configure do |config|
+    #   config.ignore_blank_values = false
+    # end
+    #
+    def ignore_blank_values=(boolean)
+      self.options[:ignore_blank_values] = boolean
+    end
+
     def arel_predicate_with_suffix(arel_predicate, suffix)
       if arel_predicate === Proc
         proc { |v| "#{arel_predicate.call(v)}#{suffix}" }

data/lib/ransack/constants.rb

@@ -50,15 +50,6 @@ module Ransack
 
     DISTINCT = 'DISTINCT '.freeze
 
-    # The most `_`-separated segments a single condition or sort key may have
-    # before Ransack rejects it as invalid instead of parsing it. Working out
-    # whether a key is an attribute, an `_and_`/`_or_` compound or a path
-    # through associations is superlinear in this count, and the key comes
-    # straight from the query string, so an unbounded one is a CPU-exhaustion
-    # denial of service (GHSA-j3f8-w227-4hh8). No real search key is this
-    # long: OR-ing every column of a very wide table stays well under it.
-    MAX_KEY_DEPTH = 200
-
     DERIVED_PREDICATES = [
       [CONT, {
         arel_predicate: 'matches'.freeze,
@@ -164,22 +155,47 @@ module Ransack
         type: :boolean,
         validator: proc { |v| BOOLEAN_VALUES.include?(v) },
         formatter: proc { |v| nil } }
+      ],
+      ['length_eq'.freeze, {
+        arel_predicate: 'eq'.freeze,
+        type: :integer
+        }
+      ],
+      ['length_lt'.freeze, {
+        arel_predicate: 'lt'.freeze,
+        type: :integer
+        }
+      ],
+      ['length_lteq'.freeze, {
+        arel_predicate: 'lteq'.freeze,
+        type: :integer
+        }
+      ],
+      ['length_gt'.freeze, {
+        arel_predicate: 'gt'.freeze,
+        type: :integer
+        }
+      ],
+      ['length_gteq'.freeze, {
+        arel_predicate: 'gteq'.freeze,
+        type: :integer
+        }
       ]
     ].freeze
 
+    # The character used to escape LIKE wildcards. Emitted as an explicit
+    # `ESCAPE` clause alongside every LIKE / NOT LIKE predicate, so the
+    # behaviour does not depend on a backend's default escape character —
+    # MySQL and PostgreSQL default to backslash, SQLite has no default at all.
+    LIKE_ESCAPE_CHARACTER = '\\'.freeze
+
   module_function
-    # replace % \ to \% \\
+    # Escapes the LIKE wildcards `%` and `_`, and the escape character itself,
+    # so they are matched literally. Paired with the `ESCAPE` clause added in
+    # `Condition#format_predicate`; escaping without it silently does nothing
+    # on SQLite. See https://github.com/activerecord-hackery/ransack/issues/1581
     def escape_wildcards(unescaped)
-      case ActiveRecord::Base.connection.adapter_name
-      when "Mysql2".freeze
-        # Necessary for MySQL
-        unescaped.to_s.gsub(/([\\%_])/, '\\\\\\1')
-      when "PostGIS".freeze, "PostgreSQL".freeze
-        # Necessary for PostgreSQL
-        unescaped.to_s.gsub(/([\\%_.])/, '\\\\\\1')
-      else
-        unescaped
-      end
+      unescaped.to_s.gsub(/([\\%_])/) { "#{LIKE_ESCAPE_CHARACTER}#{$1}" }
     end
   end
 end

data/lib/ransack/context.rb

@@ -3,8 +3,7 @@ require 'ransack/visitor'
 module Ransack
   class Context
     attr_reader :search, :object, :klass, :base, :engine, :arel_visitor
-    attr_accessor :auth_object, :search_key
-    attr_reader :arel_visitor
+    attr_accessor :auth_object, :search_key, :ignore_unknown_conditions
 
     class << self
 
@@ -34,6 +33,12 @@ module Ransack
 
     end # << self
 
+    # Unknown attributes, predicates and combinators raise rather than being
+    # ignored when either the global option or this search's own option says so.
+    def strict_conditions?
+      !Ransack.options[:ignore_unknown_conditions] || ignore_unknown_conditions == false
+    end
+
     def initialize(object, options = {})
       @object = relation_for(object)
       @klass = @object.klass
@@ -47,15 +52,6 @@ module Ransack
       @base = @join_dependency.instance_variable_get(:@join_root)
     end
 
-    # False when a key has more `_`-separated segments than Ransack will
-    # parse. The attribute / association / predicate parsing that follows is
-    # superlinear in the segment count and the key is attacker-controlled, so
-    # an over-long key is treated as unknown rather than parsed
-    # (GHSA-j3f8-w227-4hh8).
-    def key_within_depth_limit?(key)
-      key.to_s.count(Constants::UNDERSCORE) <= Constants::MAX_KEY_DEPTH
-    end
-
     def bind_pair_for(key)
       @bind_pairs ||= {}
 
@@ -98,6 +94,14 @@ module Ransack
       @klass.method(scope).arity
     end
 
+    def sanitize_scope_args(key, args)
+      if Ransack.options[:sanitize_scope_args] && !ransackable_scope_skip_sanitize_args?(key, object)
+        cast_scope_args(args)
+      else
+        args
+      end
+    end
+
     def bind(object, str)
       return nil unless str
       object.parent, object.attr_name = bind_pair_for(str)
@@ -133,8 +137,6 @@ module Ransack
     end
 
     def association_path(str, base = @base)
-      return ''.freeze unless key_within_depth_limit?(str)
-
       base = klassify(base)
       str ||= ''.freeze
       path = []
@@ -170,8 +172,11 @@ module Ransack
     end
 
     def ransackable_attribute?(str, klass)
-      klass.ransackable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym } ||
-        klass.ransortable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym }
+      klass.ransackable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym }
+    end
+
+    def ransortable_attribute?(str, klass)
+      klass.ransortable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym }
     end
 
     def ransackable_association?(str, klass)
@@ -197,5 +202,21 @@ module Ransack
     def searchable_associations(str = ''.freeze)
       traverse(str).ransackable_associations(auth_object)
     end
+
+    private
+
+    def cast_scope_args(args)
+      if args.is_a?(Array)
+        args = args.map(&method(:cast_scope_args))
+      end
+
+      if Constants::TRUE_VALUES.include? args
+        true
+      elsif Constants::FALSE_VALUES.include? args
+        false
+      else
+        args
+      end
+    end
   end
 end

data/lib/ransack/helpers/form_builder.rb

@@ -1,22 +1,5 @@
 require 'action_view'
 
-module ActionView::Helpers::Tags
-  # TODO: Find a better way to solve this issue!
-  # This patch is needed since this Rails commit:
-  # https://github.com/rails/rails/commit/c1a118a
-  class Base
-    private
-
-    def value
-      if @allow_method_names_outside_object
-        object.send @method_name if object && object.respond_to?(@method_name, true)
-      else
-        object.send @method_name if object
-      end
-    end
-  end
-end
-
 RANSACK_FORM_BUILDER = 'RANSACK_FORM_BUILDER'.freeze
 
 require 'simple_form' if
@@ -129,6 +112,7 @@ module Ransack
 
       def predicate_select(options = {}, html_options = {})
         options[:compounds] = true if options[:compounds].nil?
+        options[:selected] ||= nil
         default = options.delete(:default) || Constants::CONT
 
         keys =

data/lib/ransack/helpers/form_helper.rb

@@ -10,7 +10,7 @@ module Ransack
         search = extract_search_and_set_url(record, options, 'search_form_for')
         options[:html] ||= {}
         html_options = build_html_options(search, options, :get)
-        finalize_form_options(options, html_options)
+        finalize_form_options(search, options, html_options)
         form_for(record, options, &proc)
       end
 
@@ -30,7 +30,7 @@ module Ransack
         search = extract_search_and_set_url(record, options, 'search_form_with')
         options[:html] ||= {}
         html_options = build_html_options(search, options, :get)
-        finalize_form_with_options(options, html_options)
+        finalize_form_with_options(search, options, html_options)
         form_with(model: search, **options, &proc)
       end
 
@@ -48,7 +48,7 @@ module Ransack
         turbo_options = build_turbo_options(options)
         method = options.delete(:method) || :post
         html_options = build_html_options(search, options, method).merge(turbo_options)
-        finalize_form_options(options, html_options)
+        finalize_form_options(search, options, html_options)
         form_for(record, options, &proc)
       end
 
@@ -122,14 +122,14 @@ module Ransack
           }
         end
 
-        def finalize_form_options(options, html_options)
-          options[:as] ||= Ransack.options[:search_key]
+        def finalize_form_options(search, options, html_options)
+          options[:as] ||= search.context.search_key
           options[:html].reverse_merge!(html_options)
           options[:builder] ||= FormBuilder
         end
 
-        def finalize_form_with_options(options, html_options)
-          options[:scope] ||= Ransack.options[:search_key]
+        def finalize_form_with_options(search, options, html_options)
+          options[:scope] ||= search.context.search_key
           options[:html].reverse_merge!(html_options)
           options[:builder] ||= FormBuilder
         end

data/lib/ransack/nodes/attribute.rb

@@ -20,8 +20,7 @@ module Ransack
 
       def valid?
         bound? && attr &&
-        context.klassify(parent).ransackable_attributes(context.auth_object)
-        .include?(attr_name.split('.').last)
+        context.ransackable_attribute?(attr_name.split('.').last, context.klassify(parent))
       end
 
       def associated_collection?
@@ -31,6 +30,8 @@ module Ransack
       def type
         if ransacker
           ransacker.type
+        elsif enum?
+          :enum
         else
           context.type_for(self)
         end
@@ -54,6 +55,14 @@ module Ransack
         "Attribute <#{name}>"
       end
 
+      private
+
+      def enum?
+        bound? &&
+        klass.respond_to?(:defined_enums) &&
+        klass.defined_enums.key?(attr_name.to_s)
+      end
+
     end
   end
 end

data/lib/ransack/nodes/condition.rb

@@ -81,8 +81,13 @@ module Ransack
       def attributes=(args)
         case args
         when Array
-          args.each do |name|
-            build_attribute(name)
+          args.each do |attr|
+            if attr.is_a?(Hash) && (attr.key?(:name) || attr.key?("name"))
+              attr = attr.with_indifferent_access
+              build_attribute(attr[:name], attr[:ransacker_args])
+            else
+              build_attribute(attr)
+            end
           end
         when Hash
           args.each do |index, attrs|
@@ -104,8 +109,10 @@ module Ransack
         case args
         when Array
           args.each do |val|
-            val = Value.new(@context, val)
-            self.values << val
+            if val.is_a?(Hash) && (val.key?(:value) || val.key?("value"))
+              val = val.with_indifferent_access[:value]
+            end
+            self.values << Value.new(@context, val)
           end
         when Hash
           args.each do |index, attrs|
@@ -124,8 +131,9 @@ module Ransack
       end
 
       def combinator=(val)
-        @combinator = Constants::AND_OR.detect { |v| v == val.to_s } || nil
+        super
       end
+
       alias :m= :combinator=
       alias :m :combinator
 
@@ -171,10 +179,17 @@ module Ransack
         end
       end
 
+      # The long spellings route through the short setters: `p=` resolves a
+      # Predicate object, whereas the `predicate=` attribute writer would store
+      # the bare name.
+      LONG_KEYS = {
+        'attributes' => 'a', 'values' => 'v', 'predicate' => 'p', 'combinator' => 'm'
+      }.freeze
+
       def build(params)
         params.with_indifferent_access.each do |key, value|
-          if key.match(/^(a|v|p|m)$/)
-            self.send("#{key}=", value)
+          if key.match(/^(a|v|p|m|attributes|values|predicate|combinator)$/)
+            self.send("#{LONG_KEYS.fetch(key, key)}=", value)
           end
         end
 
@@ -217,10 +232,6 @@ module Ransack
       end
       alias :p :predicate_name
 
-      def arel_predicate
-        raise "not implemented"
-      end
-
       def validated_values
         values.select { |v| predicate.validator.call(v.value) }
       end
@@ -260,7 +271,7 @@ module Ransack
       end
 
       def attr_value_for_attribute(attr)
-        return attr.attr if ActiveRecord::Base.connection.adapter_name == "PostgreSQL"
+        return attr.attr if ActiveRecord::Base.adapter_class::ADAPTER_NAME == "PostgreSQL"
 
         predicate.case_insensitive ? attr.attr.lower : attr.attr
       rescue
@@ -289,11 +300,11 @@ module Ransack
       end
 
       def arel_predicate
-        predicate = attributes.map { |attribute|
+        attributes.map { |attribute|
           association = attribute.parent
           parent_table = association.table
 
-          if negative? && attribute.associated_collection? && not_nested_condition(attribute, parent_table)
+          predicate = if negative? && attribute.associated_collection? && not_nested_condition(attribute, parent_table)
             query = context.build_correlated_subquery(association)
             context.remove_association(association)
 
@@ -316,18 +327,22 @@ module Ransack
           else
             format_predicate(attribute)
           end
-        }.reduce(combinator_method)
 
-        if replace_right_node?(predicate)
-          # Replace right node object to plain integer value in order to avoid
-          # ActiveModel::RangeError from Arel::Node::Casted.
-          # The error can be ignored here because RDBMSs accept large numbers
-          # in condition clauses.
-          plain_value = predicate.right.value
-          predicate.right = plain_value
-        end
+          # Applied per attribute rather than to the reduced node: once several
+          # attributes are combined, the result is an And/Or whose `right` is
+          # another predicate node rather than a Casted value, so
+          # replace_right_node? returns false and nothing is unwrapped at all.
+          if replace_right_node?(predicate)
+            # Replace right node object to plain integer value in order to avoid
+            # ActiveModel::RangeError from Arel::Node::Casted.
+            # The error can be ignored here because RDBMSs accept large numbers
+            # in condition clauses.
+            plain_value = predicate.right.value
+            predicate.right = plain_value
+          end
 
-        predicate
+          predicate
+        }.reduce(combinator_method)
       end
 
       def not_nested_condition(attribute, parent_table)
@@ -343,14 +358,39 @@ module Ransack
       def format_predicate(attribute)
         arel_pred = arel_predicate_for_attribute(attribute)
         arel_values = formatted_values_for_attribute(attribute)
-        
+
+        # The `present` / `blank` predicate formatters produce `[nil, '']` regardless
+        # of column type. The empty-string half has no meaning on non-string columns:
+        # ActiveRecord casts `''` to NULL for those types, producing the
+        # always-UNKNOWN `column != NULL` (or `column = NULL`) clause. Strip the
+        # empty string when the attribute is not a string-like column.
+        if arel_values.is_a?(Array) && arel_values.include?(''.freeze) && !string_like_attribute?(attribute)
+          arel_values = arel_values.reject { |v| v == ''.freeze }
+        end
+
         # For LIKE predicates, wrap the value in Arel::Nodes.build_quoted to prevent
-        # ActiveRecord normalization from affecting wildcard patterns
+        # ActiveRecord normalization from affecting wildcard patterns, and pass
+        # the escape character so the escaping done by `escape_wildcards` is
+        # actually honoured. Without an explicit ESCAPE clause, SQLite treats a
+        # backslash as a literal character rather than an escape.
+        # See https://github.com/activerecord-hackery/ransack/issues/1581
+        # A length predicate compares LENGTH(column) rather than the column.
+        attr_value = length_predicate? ? length_function_for_attribute(attribute) : attr_value_for_attribute(attribute)
+
         if like_predicate?(arel_pred)
-          arel_values = Arel::Nodes.build_quoted(arel_values)
+          # The compound forms (matches_any / matches_all and their negations)
+          # iterate over an Array of patterns, so each element is quoted on its
+          # own; wrapping the whole Array in one node would hand them a single
+          # Quoted to iterate over.
+          arel_values = if arel_values.is_a?(Array)
+            arel_values.map { |v| Arel::Nodes.build_quoted(v) }
+          else
+            Arel::Nodes.build_quoted(arel_values)
+          end
+          predicate = attr_value.public_send(arel_pred, arel_values, Constants::LIKE_ESCAPE_CHARACTER)
+        else
+          predicate = attr_value.public_send(arel_pred, arel_values)
         end
-        
-        predicate = attr_value_for_attribute(attribute).public_send(arel_pred, arel_values)
 
         if in_predicate?(predicate)
           predicate.right = predicate.right.map do |pr|
@@ -366,8 +406,22 @@ module Ransack
         predicate.class == Arel::Nodes::In || predicate.class == Arel::Nodes::NotIn
       end
 
+      LIKE_PREDICATES = %w[
+        matches matches_any matches_all
+        does_not_match does_not_match_any does_not_match_all
+      ].freeze
+
       def like_predicate?(arel_predicate)
-        arel_predicate == 'matches' || arel_predicate == 'does_not_match'
+        LIKE_PREDICATES.include?(arel_predicate)
+      end
+
+      STRING_LIKE_TYPES = %i[string text citext].freeze
+
+      def string_like_attribute?(attribute)
+        type = attribute.type
+        # Treat unknown types as string-like (conservative: keep the existing
+        # empty-string comparison rather than silently dropping it).
+        type.nil? || STRING_LIKE_TYPES.include?(type.to_sym)
       end
 
       def casted_array?(predicate)
@@ -391,6 +445,28 @@ module Ransack
         attribute_type == :integer && arel_node.value.is_a?(Integer)
       end
 
+      def length_predicate?
+        predicate_name.to_s.start_with?('length_')
+      end
+
+      # CHAR_LENGTH counts characters and is the SQL standard spelling; SQLite
+      # has no CHAR_LENGTH and its LENGTH already counts characters for text.
+      CHAR_LENGTH_ADAPTERS = %w[PostgreSQL PostGIS Mysql2 Trilogy].freeze
+
+      def length_function_for_attribute(attribute)
+        function_name =
+          if CHAR_LENGTH_ADAPTERS.include?(ActiveRecord::Base.adapter_class::ADAPTER_NAME)
+            'CHAR_LENGTH'.freeze
+          else
+            'LENGTH'.freeze
+          end
+
+        Arel::Nodes::NamedFunction.new(
+          function_name,
+          [attr_value_for_attribute(attribute)]
+        )
+      end
+
       def valid_combinator?
         attributes.size < 2 || Constants::AND_OR.include?(combinator)
       end

data/lib/ransack/nodes/grouping.rb

@@ -1,8 +1,12 @@
 module Ransack
   module Nodes
     class Grouping < Node
-      attr_reader :conditions
-      attr_accessor :combinator
+      attr_reader :combinator
+
+      # The writer is inherited from Node, which normalises the value. Defining
+      # it here as well — or aliasing before the definition is in place — would
+      # bind `m=` to the plain attribute writer and skip that normalisation,
+      # which is how `g: [{ m: 'OR' }]` silently fell back to AND.
       alias :m :combinator
       alias :m= :combinator=
 
@@ -13,7 +17,7 @@ module Ransack
 
       def initialize(context, combinator = nil)
         super(context)
-        self.combinator = combinator.to_s if combinator
+        self.combinator = combinator if combinator
       end
 
       def persisted?
@@ -122,8 +126,6 @@ module Ransack
       end
 
       def attribute_method?(name)
-        return false unless @context.key_within_depth_limit?(name)
-
         stripped_name = strip_predicate_and_index(name)
         return true if @context.attribute_method?(stripped_name) ||
                        @context.attribute_method?(name)
@@ -151,10 +153,14 @@ module Ransack
       def build(params)
         params.with_indifferent_access.each do |key, value|
           case key
-          when /^(g|c|m)$/
+          when /^(g|c|m|groupings|conditions|combinator)$/
             self.send("#{key}=", value)
           else
-            write_attribute(key.to_s, value)
+            if @context.ransackable_scope?(key, @context.object)
+              @context.chain_scope(key, @context.sanitize_scope_args(key, value))
+            else
+              write_attribute(key.to_s, value)
+            end
           end
         end
         self
@@ -180,6 +186,16 @@ module Ransack
       end
 
       def read_attribute(name)
+        # A field built from an aliased attribute writes its value under the real
+        # name but reads it back under the alias. Resolve the alias so the
+        # value survives a form round-trip (#689).
+        if self[name].nil?
+          stripped_name = name.dup
+          predicate = Predicate.detect_and_strip_from_string!(stripped_name)
+          aliased_attribute = context.ransackable_alias(stripped_name)
+          name = "#{aliased_attribute}_#{predicate}" unless aliased_attribute == stripped_name
+        end
+
         if self[name].respond_to?(:value)
           self[name].value
         else

data/lib/ransack/nodes/node.rb

@@ -29,6 +29,19 @@ module Ransack
         end
       end
 
+      # Every way of supplying a combinator — a top-level `combinator`/`m`,
+      # or an `m` inside any nested grouping or condition — ends up here, so
+      # this is the one place that normalises the spelling and, when the search
+      # is strict, rejects a value it does not recognise.
+      def combinator=(val)
+        normalised = val.to_s.downcase
+        @combinator = Constants::AND_OR.detect { |v| v == normalised }
+
+        if @combinator.nil? && !normalised.empty? && context&.strict_conditions?
+          raise InvalidSearchError, "Invalid combinator #{val}"
+        end
+      end
+
     end
   end
 end

data/lib/ransack/nodes/sort.rb

@@ -26,8 +26,7 @@ module Ransack
 
       def valid?
         bound? && attr &&
-        context.klassify(parent).ransortable_attributes(context.auth_object)
-        .include?(attr_name)
+          context.ransortable_attribute?(attr_name.split('.').last, context.klassify(parent))
       end
 
       def name=(name)

data/lib/ransack/nodes/value.rb

@@ -24,9 +24,11 @@ module Ransack
 
       def cast(type)
         case type
+        when :enum
+          value
         when :date
           cast_to_date(value)
-        when :datetime, :timestamp, :time, :timestamptz
+        when :datetime, :timestamp, :time, :timestamptz, :datetimeoffset
           cast_to_time(value)
         when :boolean
           cast_to_boolean(value)

data/lib/ransack/predicate.rb

@@ -3,6 +3,17 @@ module Ransack
     attr_reader :name, :arel_predicate, :type, :formatter, :validator,
                 :compound, :wants_array, :case_insensitive
 
+    # Consulted at search time rather than captured at predicate-definition
+    # time, so that `Ransack.options[:ignore_blank_values]` set in an
+    # initializer applies to the predicates registered before it ran.
+    DEFAULT_VALIDATOR = lambda do |v|
+      if Ransack.options[:ignore_blank_values]
+        v.respond_to?(:empty?) ? !v.empty? : !v.nil?
+      else
+        !v.nil?
+      end
+    end
+
     class << self
 
       def names
@@ -37,8 +48,7 @@ module Ransack
       @arel_predicate = opts[:arel_predicate]
       @type = opts[:type]
       @formatter = opts[:formatter]
-      @validator = opts[:validator] ||
-        lambda { |v| v.respond_to?(:empty?) ? !v.empty? : !v.nil? }
+      @validator = opts[:validator] || DEFAULT_VALIDATOR
       @compound = opts[:compound]
       @wants_array = opts.fetch(:wants_array,
         @compound || Constants::IN_NOT_IN.include?(@arel_predicate))
@@ -64,7 +74,18 @@ module Ransack
     end
 
     def validate(vals, type = @type)
-      vals.any? { |v| validator.call(type ? v.cast(type) : v.value) }
+      # An explicitly empty array is a meaningful filter (matching nothing)
+      # rather than an absent one, but only when blank values are not ignored.
+      return true if vals.empty? && wants_array &&
+                     !Ransack.options[:ignore_blank_values]
+
+      # When blank values are meaningful, validate the value as given. Casting
+      # first would turn '' into nil for an integer or boolean column and the
+      # explicit blank would be dropped — leaving no condition at all.
+      vals.any? do |v|
+        value = type && Ransack.options[:ignore_blank_values] ? v.cast(type) : v.value
+        validator.call(value)
+      end
     end
 
     def negative?

data/lib/ransack/search.rb

@@ -24,14 +24,19 @@ module Ransack
       strip_whitespace = options.fetch(:strip_whitespace, Ransack.options[:strip_whitespace])
       params = params.to_unsafe_h if params.respond_to?(:to_unsafe_h)
       if params.is_a? Hash
-        params = params.dup
-        params = params.transform_values { |v| v.is_a?(String) && strip_whitespace ? v.strip : v }
-        params.delete_if { |k, v| [*v].all?{ |i| i.blank? && i != false } }
+        # deep_transform_values rebuilds every nested hash and array, which
+        # also gives the pruning below a private copy to edit — the caller's
+        # params come back untouched. Values nested inside `g:` groupings and
+        # `c:` conditions are stripped too, not just the top level.
+        params = params.deep_transform_values { |v| v.is_a?(String) && strip_whitespace ? v.strip : v }
+        params.delete_if { |_k, v| blank_condition_value?(v) }
+        prune_blank_advanced_conditions!(params)
       else
         params = {}
       end
       @context = options[:context] || Context.for(object, options)
       @context.auth_object = options[:auth_object]
+      @context.ignore_unknown_conditions = options[:ignore_unknown_conditions]
       @base = Nodes::Grouping.new(
         @context, options[:grouping] || Constants::AND
         )
@@ -132,11 +137,7 @@ module Ransack
     private
 
     def add_scope(key, args)
-      sanitized_args = if Ransack.options[:sanitize_scope_args] && !@context.ransackable_scope_skip_sanitize_args?(key, @context.object)
-        sanitized_scope_args(args)
-      else
-        args
-      end
+      sanitized_args = @context.sanitize_scope_args(key, args)
 
       if @context.scope_arity(key) == 1
         @scope_args[key] = args.is_a?(Array) ? args[0] : args
@@ -146,45 +147,19 @@ module Ransack
       @context.chain_scope(key, sanitized_args)
     end
 
-    def sanitized_scope_args(args)
-      if args.is_a?(Array)
-        args = args.map(&method(:sanitized_scope_args))
-      end
-
-      if Constants::TRUE_VALUES.include? args
-        true
-      elsif Constants::FALSE_VALUES.include? args
-        false
-      else
-        args
-      end
-    end
-
-    # The largest position a multiparameter key (`created_at(1i)`) may carry.
-    # Rails' date and time selects emit at most six, year to second. The
-    # position indexes an array, so an unbounded one from a crafted query
-    # string would allocate an array that size (GHSA-vxc9-rm8f-p56j).
-    MULTIPARAMETER_POSITION_LIMIT = 16
-
-    # Folds `created_at(1i)`, `created_at(2i)`, ... into `created_at` as an
-    # array of cast values, the way Active Record does for form input. The
-    # keys are untrusted, so a malformed one is dropped rather than raised
-    # on: no position (`created_at(`), a position outside 1 to the limit,
-    # or a fragment for an attribute that was also given as a plain value.
     def collapse_multiparameter_attributes!(attrs)
       attrs.keys.each do |k|
         if k.include?(Constants::LEFT_PARENTHESIS)
           real_attribute, position = k.split(/\(|\)/)
-          value = attrs.delete(k)
-          next if position.nil?
-
-          cast = Constants::A_S_I.include?(position.last) ? position.last : nil
+          cast =
+          if Constants::A_S_I.include?(position.last)
+            position.last
+          else
+            nil
+          end
           position = position.to_i - 1
-          next if position < 0 || position >= MULTIPARAMETER_POSITION_LIMIT
-
+          value = attrs.delete(k)
           attrs[real_attribute] ||= []
-          next unless attrs[real_attribute].is_a?(Array)
-
           attrs[real_attribute][position] =
           if cast
             if value.blank? && cast == Constants::I
@@ -203,5 +178,61 @@ module Ransack
       attrs
     end
 
+    # True when a condition's value should be dropped before building. With
+    # `ignore_blank_values` on (the default) a blank value means "this form
+    # field was left empty"; with it off, only nil is treated that way and a
+    # blank value is a value to search for. `false` is always a real value, and
+    # an explicit nil inside an array is kept so `name_in: [nil]` still reaches
+    # the query. The `c:` pruning below shares this, so it follows the option.
+    def blank_condition_value?(value)
+      if Ransack.options[:ignore_blank_values]
+        [*value].all? { |i| i.blank? && i != false && !i.nil? }
+      else
+        value.nil? || (value.is_a?(Array) && !value.empty? && value.all?(&:nil?))
+      end
+    end
+
+    # The low-level `c:` API nests its values a level deeper than the shorthand
+    # form, so the filter above never sees them. Left in place, a condition with
+    # an empty value still builds its attribute and contributes a join, giving a
+    # LEFT OUTER JOIN with no WHERE clause to go with it.
+    def prune_blank_advanced_conditions!(node)
+      return unless node.is_a?(Hash)
+
+      conditions = fetch_either(node, :c, :conditions)
+      case conditions
+      when Array then conditions.delete_if { |c| blank_advanced_condition?(c) }
+      when Hash  then conditions.delete_if { |_k, c| blank_advanced_condition?(c) }
+      end
+
+      # Groupings nest to any depth and carry their own conditions, so descend
+      # into each of them too.
+      groupings = fetch_either(node, :g, :groupings)
+      groupings = groupings.values if groupings.is_a?(Hash)
+      Array(groupings).each { |grouping| prune_blank_advanced_conditions!(grouping) }
+    end
+
+    # Params are not yet indifferent-access here, so look under both spellings
+    # of a key and both its short and long forms.
+    def fetch_either(hash, short, long)
+      hash[short] || hash[short.to_s] || hash[long] || hash[long.to_s]
+    end
+
+    def blank_advanced_condition?(condition)
+      return false unless condition.is_a?(Hash)
+
+      values = condition[:v] || condition['v']
+
+      case values
+      when Array then values.all? { |v| blank_condition_value?(unwrap_value(v)) }
+      when Hash  then values.all? { |_k, v| blank_condition_value?(unwrap_value(v)) }
+      end
+    end
+
+    # Values in the `c:` API may be given bare or wrapped in a `{ value: ... }`
+    # envelope, the same two forms `Condition#values=` accepts.
+    def unwrap_value(value)
+      value.is_a?(Hash) ? (value[:value] || value['value']) : value
+    end
   end
 end

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '4.4.3'
+  VERSION = '5.0.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 4.4.3
+  version: 5.0.0
 platform: ruby
 authors:
 - Ernie Miller