ransack 5.0.1 → 6.0.0

data/lib/ransack/active_record/join_association.rb

@@ -0,0 +1,104 @@
+module Ransack
+  module ActiveRecord
+    # Prepended to ActiveRecord::Associations::JoinDependency::JoinAssociation.
+    #
+    # Adds the join type and the polymorphic class to a join association, and
+    # a variant of #join_constraints that builds against tables Ransack has
+    # already aliased, so a correlated subquery for a negative condition on a
+    # collection uses the same aliases as the outer query.
+    module JoinAssociationExtensions
+      def self.prepended(base)
+        base.class_eval { attr_reader :join_type }
+      end
+
+      def initialize(reflection, children, polymorphic_class = nil, join_type = Arel::Nodes::InnerJoin)
+        @join_type = join_type
+        if polymorphic_class && ::ActiveRecord::Base > polymorphic_class
+          swapping_reflection_klass(reflection, polymorphic_class) do |reflection|
+            super(reflection, children)
+            self.reflection.options[:polymorphic] = true
+          end
+        else
+          super(reflection, children)
+        end
+      end
+
+      # A polymorphic reflection has no class of its own. To join it to one
+      # concrete class, work on a copy of the reflection that names that class
+      # and drops the polymorphic option; the shared reflection on the model
+      # is left untouched, so this is safe across threads.
+      def swapping_reflection_klass(reflection, klass)
+        new_reflection = reflection.clone
+        new_reflection.instance_variable_set(:@options, reflection.options.clone)
+        new_reflection.options.delete(:polymorphic)
+        new_reflection.instance_variable_set(:@klass, klass)
+        yield new_reflection
+      end
+
+      # Same as #join_constraints, but instead of constructing tables from the
+      # given block, uses the ones passed
+      def join_constraints_with_tables(foreign_table, foreign_klass, join_type, alias_tracker, tables)
+        joins = []
+        chain = []
+
+        reflection.chain.each.with_index do |reflection, i|
+          table = tables[i]
+
+          @table ||= table
+          chain << [reflection, table]
+        end
+
+        # The chain starts with the target table, but we want to end with it here (makes
+        # more sense in this context), so we reverse
+        chain.reverse_each do |reflection, table|
+          klass = reflection.klass
+
+          join_scope = reflection.join_scope(table, foreign_table, foreign_klass)
+
+          unless join_scope.references_values.empty?
+            join_dependency = join_scope.construct_join_dependency(
+              join_scope.eager_load_values | join_scope.includes_values, Arel::Nodes::OuterJoin
+            )
+            join_scope.joins!(join_dependency)
+          end
+
+          arel = join_scope.arel(alias_tracker.aliases)
+          nodes = arel.constraints.first
+
+          if nodes.is_a?(Arel::Nodes::And)
+            others = nodes.children.extract! do |node|
+              !Arel.fetch_attribute(node) { |attr| attr.relation.name == table.name }
+            end
+          end
+
+          joins << table.create_join(table, table.create_on(nodes), join_type)
+
+          if others && !others.empty?
+            joins.concat arel.join_sources
+            append_constraints_to(joins.last, others)
+          end
+
+          # The current table in this iteration becomes the foreign table in the next
+          foreign_table, foreign_klass = table, klass
+        end
+
+        joins
+      end
+
+      private
+
+      # Active Record's private append_constraints takes a leading connection
+      # argument in 7.2.0–7.2.2.2 and 8.0.0–8.0.2, and none in 7.2.3+, 8.0.3+
+      # and 8.1; the arity says which is loaded.
+      def append_constraints_to(join, constraints)
+        if method(:append_constraints).arity == 3
+          base_klass.with_connection do |connection|
+            append_constraints(connection, join, constraints)
+          end
+        else
+          append_constraints(join, constraints)
+        end
+      end
+    end
+  end
+end

data/lib/ransack/active_record/join_dependency.rb

@@ -0,0 +1,123 @@
+module Ransack
+  module ActiveRecord
+    # Prepended to ActiveRecord::Associations::JoinDependency.
+    #
+    # Teaches the join tree about Join nodes (join type, polymorphic class),
+    # and exposes the table aliasing Ransack needs to add one association at a
+    # time to a relation that may already carry joins of its own.
+    module JoinDependencyExtensions
+      # Replaces ActiveRecord::Associations::JoinDependency#build
+      def build(associations, base_klass)
+        associations.map do |name, right|
+          if name.is_a? Join
+            reflection = find_reflection base_klass, name.name
+            reflection.check_validity!
+            reflection.check_eager_loadable!
+
+            klass = if reflection.polymorphic?
+              name.klass || base_klass
+            else
+              reflection.klass
+            end
+            JoinAssociation.new(reflection, build(right, klass), name.klass, name.type)
+          else
+            reflection = find_reflection base_klass, name
+            reflection.check_validity!
+            reflection.check_eager_loadable!
+
+            if reflection.polymorphic?
+              raise ::ActiveRecord::EagerLoadPolymorphicError.new(reflection)
+            end
+            JoinAssociation.new(reflection, build(right, reflection.klass))
+          end
+        end
+      end
+
+      def join_constraints(joins_to_add, alias_tracker, references)
+        @alias_tracker = alias_tracker
+        @joined_tables = {}
+        @references = {}
+
+        references.each do |table_name|
+          @references[table_name.to_sym] = table_name if table_name.is_a?(String)
+        end
+
+        joins = make_join_constraints(join_root, join_type)
+
+        joins.concat joins_to_add.flat_map { |oj|
+          if join_root.match?(oj.join_root) && join_root.table.name == oj.join_root.table.name
+            walk join_root, oj.join_root, oj.join_type
+          else
+            make_join_constraints(oj.join_root, oj.join_type)
+          end
+        }
+      end
+
+      def construct_tables_for_association!(join_root, association, join_type = self.join_type)
+        tables = table_aliases_for(join_root, association, join_type)
+        association.table = tables.first
+        tables
+      end
+
+      private
+
+      # The tables for a node's reflection chain, assigned the way Active
+      # Record's JoinDependency#make_constraints assigns them, so that the
+      # aliases Ransack binds conditions to are the ones the query will have.
+      # Once a chain tail has been joined before, Active Record stops
+      # aliasing and reuses that join; the remaining positions here are
+      # filled from the same record for the correlated-subquery builder.
+      def table_aliases_for(parent, node, join_type)
+        @joined_tables ||= {}
+        chain = node.reflection.chain
+        terminated_at = nil
+
+        chain.each_with_index.map { |reflection, index|
+          remaining = chain[index..]
+          table, terminated = @joined_tables[remaining]
+          root = reflection == node.reflection
+
+          if terminated_at
+            table || reflection.klass.arel_table
+          elsif table && (!root || !terminated)
+            @joined_tables[remaining] = [table, root] if root
+            terminated_at = index
+            table
+          else
+            table_name = @references && @references[reflection.name.to_sym]&.to_s
+            table = alias_tracker.aliased_table_for(reflection.klass.arel_table, table_name) do
+              name = reflection.alias_candidate(parent.table_name)
+              root ? name : "#{name}_join"
+            end
+            @joined_tables[remaining] ||= [table, root] if join_type == Arel::Nodes::OuterJoin
+            table
+          end
+        }
+      end
+
+      module ClassMethods
+        # Prepended before ActiveRecord::Associations::JoinDependency#walk_tree
+        #
+        def walk_tree(associations, hash)
+          case associations
+          when TreeNode
+            associations.add_to_tree(hash)
+          when Hash
+            associations.each do |k, v|
+              cache =
+                if TreeNode === k
+                  k.add_to_tree(hash)
+                else
+                  hash[k] ||= {}
+                end
+              walk_tree(v, cache)
+            end
+          else
+            super(associations, hash)
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/ransack/active_record/reflection.rb

@@ -0,0 +1,18 @@
+module Ransack
+  module ActiveRecord
+    # Prepended to ActiveRecord::Reflection::AbstractReflection.
+    #
+    # When a polymorphic belongs_to is joined to one concrete class, the join
+    # must also constrain the type column, or rows pointing at a different
+    # class with a colliding id would match.
+    module ReflectionExtensions
+      def join_scope(table, foreign_table, foreign_klass)
+        if respond_to?(:polymorphic?) && polymorphic?
+          super.where!(foreign_table[foreign_type].eq(klass.name))
+        else
+          super
+        end
+      end
+    end
+  end
+end

data/lib/ransack/active_record/tree_node.rb

@@ -0,0 +1,13 @@
+module Ransack
+  module ActiveRecord
+    # Anything that can be placed in the association tree handed to
+    # JoinDependency. Active Record's own tree is built from symbols and
+    # hashes; a TreeNode adds itself to that tree however it likes, which is
+    # how a Join carries its join type and polymorphic class through.
+    module TreeNode
+      def add_to_tree(hash)
+        raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/ransack/active_record.rb

@@ -1,14 +1,49 @@
-require 'ransack/adapters/active_record/base'
+require 'ransack/active_record/base'
+require 'ransack/active_record/dialect'
+require 'ransack/active_record/context'
 
 ActiveSupport.on_load(:active_record) do
-  extend Ransack::Adapters::ActiveRecord::Base
-
-  Ransack::SUPPORTS_ATTRIBUTE_ALIAS =
-  begin
-    ActiveRecord::Base.respond_to?(:attribute_aliases)
-  rescue NameError
-    false
+  module Ransack
+    # Everything Ransack needs from Active Record lives under this module: the
+    # class methods mixed into every model (Base), the Context that turns a
+    # search into a relation, and the extensions to Active Record's join
+    # machinery that let Ransack build outer joins and polymorphic joins the
+    # public query interface cannot express.
+    module ActiveRecord
+      JoinDependency  = ::ActiveRecord::Associations::JoinDependency
+      JoinAssociation = ::ActiveRecord::Associations::JoinDependency::JoinAssociation
+    end
   end
+
+  require 'ransack/active_record/tree_node'
+  require 'ransack/active_record/join'
+  require 'ransack/active_record/join_association'
+  require 'ransack/active_record/join_dependency'
+  require 'ransack/active_record/reflection'
+
+  ::ActiveRecord::Reflection::AbstractReflection.prepend Ransack::ActiveRecord::ReflectionExtensions
+  Ransack::ActiveRecord::JoinDependency.prepend Ransack::ActiveRecord::JoinDependencyExtensions
+  Ransack::ActiveRecord::JoinDependency.singleton_class.prepend Ransack::ActiveRecord::JoinDependencyExtensions::ClassMethods
+  Ransack::ActiveRecord::JoinAssociation.prepend Ransack::ActiveRecord::JoinAssociationExtensions
+
+  extend Ransack::ActiveRecord::Base
 end
 
-require 'ransack/adapters/active_record/context'
+module Ransack
+  # Ransack 5 and earlier kept the Active Record integration under
+  # Ransack::Adapters::ActiveRecord, a leftover from when Mongoid was also
+  # supported. Initializers that reopen it — usually to change the default
+  # `ransackable_attributes` — keep working for one more major release, with a
+  # deprecation warning pointing at the new name.
+  module Adapters
+    def self.const_missing(name)
+      return super unless name == :ActiveRecord
+
+      Ransack.deprecator.warn(
+        'Ransack::Adapters::ActiveRecord is deprecated and will be removed ' \
+        'in Ransack 7.0. Use Ransack::ActiveRecord instead.'
+      )
+      const_set(:ActiveRecord, Ransack::ActiveRecord)
+    end
+  end
+end

data/lib/ransack/configuration.rb

@@ -36,7 +36,9 @@ module Ransack
       sanitize_scope_args: true,
       fields_sort_option: nil,
       strip_whitespace: true,
-      ignore_blank_values: true
+      ignore_blank_values: true,
+      dialect: nil,
+      null_sentinel: nil
     }
 
     def configure
@@ -230,6 +232,52 @@ module Ransack
       self.options[:ignore_blank_values] = boolean
     end
 
+    # Ransack works out which SQL dialect a model's database speaks from the
+    # connection adapter's class: PostgreSQL, MySQL (mysql2 and trilogy) and
+    # SQLite are recognised, as is any adapter that subclasses one of them,
+    # and anything else uses standard SQL only. For an adapter that speaks a
+    # known dialect without inheriting from Rails' adapter for it, name the
+    # dialect explicitly:
+    #
+    # Ransack.configure do |config|
+    #   config.dialect = :postgresql # or :mysql, :sqlite, :generic
+    # end
+    #
+    def dialect=(name)
+      self.options[:dialect] = name&.to_sym
+    end
+
+    # Unset by default, so no application changes behavior on upgrade. Set
+    # this to a unique String value that cannot occur in your data, and an
+    # `eq` or `in` predicate (including their `_any` compounds) treats it as
+    # a request to also match `NULL`, instead of as a literal value to
+    # search for. A blank String, `false`, or a non-String value is not
+    # supported and produces undefined behavior:
+    #
+    # Ransack.configure do |config|
+    #   config.null_sentinel = '__ransack_null__'
+    # end
+    #
+    #   name_in: ['Ernie']              # name IN ('Ernie')
+    #   name_in: ['Ernie', '__ransack_null__']
+    #                                   # (name IN ('Ernie') OR name IS NULL)
+    #   name_in: ['__ransack_null__']   # name IS NULL
+    #
+    # A single multi-value form field can express all three states this
+    # way, with no change to the field's name and no controller-side
+    # rewriting. `eq` takes one value, so through it the sentinel means
+    # `IS NULL` alone; "a value or NULL" from one field needs `in` or an
+    # `_any` compound.
+    #
+    # This does not bypass `ransackable_attributes`: `NULL` on an exposed
+    # attribute is already reachable through the built-in `null` predicate.
+    #
+    # See https://github.com/activerecord-hackery/ransack/issues/940
+    #
+    def null_sentinel=(value)
+      self.options[:null_sentinel] = value
+    end
+
     def arel_predicate_with_suffix(arel_predicate, suffix)
       if arel_predicate === Proc
         proc { |v| "#{arel_predicate.call(v)}#{suffix}" }

data/lib/ransack/constants.rb

@@ -39,6 +39,21 @@ module Ransack
     ].freeze
     A_S_I               = ['a'.freeze, 's'.freeze, 'i'.freeze].freeze
 
+    # The predicates `Ransack.options[:null_sentinel]` applies to. Limited to
+    # the positive equality family (`eq`, `in`, and their `_any` compounds)
+    # because these are the only predicates where "or is null" is
+    # unambiguous. The `_all` compounds are excluded because they are
+    # conjunctive: `eq_all`/`in_all` require a single column to equal every
+    # supplied value at once, so ORing in `IS NULL` would widen a query that
+    # already matches nothing (or almost nothing) rather than narrow it. A
+    # negative predicate treats the sentinel as a literal value for the same
+    # reason of unambiguity: `not_eq` matching the sentinel would otherwise
+    # mean "is not unassigned", which reads as the opposite of what a caller
+    # submitting it alone almost certainly wants.
+    NULL_SENTINEL_PREDICATES = [
+      'eq'.freeze, 'in'.freeze, 'eq_any'.freeze, 'in_any'.freeze
+    ].freeze
+
     EQ                  = 'eq'.freeze
     NOT_EQ              = 'not_eq'.freeze
     EQ_ANY              = 'eq_any'.freeze
@@ -50,6 +65,15 @@ module Ransack
 
     DISTINCT = 'DISTINCT '.freeze
 
+    # The most `_`-separated segments a single condition or sort key may have
+    # before Ransack rejects it as invalid instead of parsing it. Working out
+    # whether a key is an attribute, an `_and_`/`_or_` compound or a path
+    # through associations is superlinear in this count, and the key comes
+    # straight from the query string, so an unbounded one is a CPU-exhaustion
+    # denial of service (GHSA-j3f8-w227-4hh8). No real search key is this
+    # long: OR-ing every column of a very wide table stays well under it.
+    MAX_KEY_DEPTH = 200
+
     DERIVED_PREDICATES = [
       [CONT, {
         arel_predicate: 'matches'.freeze,
@@ -83,6 +107,18 @@ module Ransack
         formatter: proc { |v| "#{escape_wildcards(v)}%" }
         }
       ],
+      ['i_start'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
+      ['not_i_start'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "#{escape_wildcards(v.downcase)}%" },
+        case_insensitive: true
+        }
+      ],
       ['end'.freeze, {
         arel_predicate: 'matches'.freeze,
         formatter: proc { |v| "%#{escape_wildcards(v)}" }
@@ -93,6 +129,18 @@ module Ransack
         formatter: proc { |v| "%#{escape_wildcards(v)}" }
         }
       ],
+      ['i_end'.freeze, {
+        arel_predicate: 'matches'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}" },
+        case_insensitive: true
+        }
+      ],
+      ['not_i_end'.freeze, {
+        arel_predicate: 'does_not_match'.freeze,
+        formatter: proc { |v| "%#{escape_wildcards(v.downcase)}" },
+        case_insensitive: true
+        }
+      ],
       ['true'.freeze, {
         arel_predicate: proc { |v| v ? EQ : NOT_EQ },
         compounds: false,
@@ -197,5 +245,18 @@ module Ransack
     def escape_wildcards(unescaped)
       unescaped.to_s.gsub(/([\\%_])/) { "#{LIKE_ESCAPE_CHARACTER}#{$1}" }
     end
+
+    def null_sentinel_predicate?(predicate_name, sentinel)
+      sentinel && NULL_SENTINEL_PREDICATES.include?(predicate_name)
+    end
+
+    def null_sentinel_value?(value, sentinel)
+      sentinel && value == sentinel
+    end
+
+    def null_sentinel_requested?(predicate_name, values, sentinel)
+      null_sentinel_predicate?(predicate_name, sentinel) &&
+        values.any? { |v| null_sentinel_value?(v.value, sentinel) }
+    end
   end
 end