ransack 5.0.0 → 5.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0251527dc22cca8cb55ff672b598d74fef0ec4c2b1c6336cb0b8d52d69dabafc
-  data.tar.gz: fd218c05d4697cca5b9a8b4111af7a5fa4ddc559071e9a3194aca2f2b2da6c9d
+  metadata.gz: 488db32f12e0902a6194cc3f5d0b4e08676b8533302f00a2bd30739f0bead9de
+  data.tar.gz: f884ce36bbb02c25a58c2293f75d1147a790075242b11fec6a24b487a1d39f19
 SHA512:
-  metadata.gz: bc524a7f9a4fac90d6f2e3b9818ccf76bab0f44c872c33db043f049f759f2641c03b338c2cfa28c70a20f6d1d2c4569390e43ec9e5da9daf2537002c519ad3fc
-  data.tar.gz: 3a599c3c9472f0033976ed0301cc0545b62711cccb36817db373c0f19ba0b828640a89bc3784b533346633112fb017353c63c490fa792b3eb3e7aea82f41e527
+  metadata.gz: eb8990b59a5d2c06eda4851c80682628f3f818cfc9d6a8e6a68c870a7e69d36e97406bc4606e0234c8a1325e8bde143930e6849eb3afbf834a707c7fa89063a6
+  data.tar.gz: 97b4c79957abc27206b8a0de0a681a13904a0e80de942c8fd0501edc03d56c166bab15f456a6c5e1abecf2f0f2a142e854b2c01509db0a85da41b258b2b7a16d

data/lib/ransack/search.rb

@@ -147,19 +147,31 @@ module Ransack
       @context.chain_scope(key, sanitized_args)
     end
 
+    # The largest position a multiparameter key (`created_at(1i)`) may carry.
+    # Rails' date and time selects emit at most six, year to second. The
+    # position indexes an array, so an unbounded one from a crafted query
+    # string would allocate an array that size (GHSA-vxc9-rm8f-p56j).
+    MULTIPARAMETER_POSITION_LIMIT = 16
+
+    # Folds `created_at(1i)`, `created_at(2i)`, ... into `created_at` as an
+    # array of cast values, the way Active Record does for form input. The
+    # keys are untrusted, so a malformed one is dropped rather than raised
+    # on: no position (`created_at(`), a position outside 1 to the limit,
+    # or a fragment for an attribute that was also given as a plain value.
     def collapse_multiparameter_attributes!(attrs)
       attrs.keys.each do |k|
         if k.include?(Constants::LEFT_PARENTHESIS)
           real_attribute, position = k.split(/\(|\)/)
-          cast =
-          if Constants::A_S_I.include?(position.last)
-            position.last
-          else
-            nil
-          end
-          position = position.to_i - 1
           value = attrs.delete(k)
+          next if position.nil?
+
+          cast = Constants::A_S_I.include?(position.last) ? position.last : nil
+          position = position.to_i - 1
+          next if position < 0 || position >= MULTIPARAMETER_POSITION_LIMIT
+
           attrs[real_attribute] ||= []
+          next unless attrs[real_attribute].is_a?(Array)
+
           attrs[real_attribute][position] =
           if cast
             if value.blank? && cast == Constants::I

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '5.0.0'
+  VERSION = '5.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.1
 platform: ruby
 authors:
 - Ernie Miller