ransack 5.0.1 → 6.0.0

data/lib/ransack/context.rb

@@ -4,31 +4,33 @@ module Ransack
   class Context
     attr_reader :search, :object, :klass, :base, :engine, :arel_visitor
     attr_accessor :auth_object, :search_key, :ignore_unknown_conditions
+    attr_writer :null_sentinel
+
+    # True when the search was built from `ActionController::Parameters` the
+    # controller permitted. A model with no allowlist of its own then lets
+    # that permit list be the boundary (see `allowlist` below).
+    attr_accessor :permitted
 
     class << self
 
-      def for_class(klass, options = {})
-        if klass < ActiveRecord::Base
-          Adapters::ActiveRecord::Context.new(klass, options)
-        end
+      # An ORM integration registers a block that returns a Context for the
+      # objects it understands and nil for anything else. Ransack ships the
+      # Active Record integration (see Ransack::ActiveRecord::Context); an
+      # integration for another ORM registers its own resolver here.
+      def register(&resolver)
+        Ransack::Context.resolvers << resolver
       end
 
-      def for_object(object, options = {})
-        case object
-        when ActiveRecord::Relation
-          Adapters::ActiveRecord::Context.new(object.klass, options)
-        end
+      def resolvers
+        @resolvers ||= []
       end
 
       def for(object, options = {})
-        context =
-          if Class === object
-            for_class(object, options)
-          else
-            for_object(object, options)
-          end
-        context or raise ArgumentError,
-          "Don't know what context to use for #{object}"
+        Ransack::Context.resolvers.each do |resolver|
+          context = resolver.call(object, options)
+          return context if context
+        end
+        raise ArgumentError, "Don't know what context to use for #{object}"
       end
 
     end # << self
@@ -39,19 +41,36 @@ module Ransack
       !Ransack.options[:ignore_unknown_conditions] || ignore_unknown_conditions == false
     end
 
+    # Falls back to the global option unless this search's own option was
+    # set, including to `false` to turn the feature off for one search. A
+    # Condition captures this when it is built, so a later search reusing
+    # this context does not change the conditions of an earlier one.
+    def null_sentinel
+      @null_sentinel.nil? ? Ransack.options[:null_sentinel] : @null_sentinel
+    end
+
     def initialize(object, options = {})
       @object = relation_for(object)
       @klass = @object.klass
-      @join_dependency = join_dependency(@object)
-      @join_type = options[:join_type] || Polyamorous::OuterJoin
+      @join_type = options[:join_type] || Arel::Nodes::OuterJoin
       @search_key = options[:search_key] || Ransack.options[:search_key]
       @associations_pot = {}
       @tables_pot = {}
       @lock_associations = []
+      @join_dependency = join_dependency(@object)
 
       @base = @join_dependency.instance_variable_get(:@join_root)
     end
 
+    # False when a key has more `_`-separated segments than Ransack will
+    # parse. The attribute / association / predicate parsing that follows is
+    # superlinear in the segment count and the key is attacker-controlled, so
+    # an over-long key is treated as unknown rather than parsed
+    # (GHSA-j3f8-w227-4hh8).
+    def key_within_depth_limit?(key)
+      key.to_s.count(Constants::UNDERSCORE) <= Constants::MAX_KEY_DEPTH
+    end
+
     def bind_pair_for(key)
       @bind_pairs ||= {}
 
@@ -61,14 +80,24 @@ module Ransack
       end
     end
 
+    # The SQL dialect the search will be rendered in, for the few places
+    # where generated SQL differs by database. See
+    # Ransack::ActiveRecord::Dialect for the questions it answers.
+    def dialect
+      raise NotImplementedError, "#{self.class} must implement #dialect"
+    end
+
+    # The model class behind a search object, an association node or a class.
+    # Each ORM integration decides what counts as a model, so this is defined
+    # on the integration's Context subclass.
     def klassify(obj)
-      if Class === obj && ::ActiveRecord::Base > obj
-        obj
-      elsif obj.respond_to? :klass
-        obj.klass
-      else
-        raise ArgumentError, "Don't know how to klassify #{obj.inspect}"
-      end
+      raise NotImplementedError, "#{self.class} must implement #klassify"
+    end
+
+    # Whether a class can be the base of a search. An ORM integration refines
+    # this; by default any class Ransack has been mixed into qualifies.
+    def searchable_class?(klass)
+      klass.respond_to?(:ransackable_attributes)
     end
 
     # Convert a string representing a chain of associations and an attribute
@@ -78,8 +107,15 @@ module Ransack
       table_for(parent)[attr_name]
     end
 
+    # A bare `false` normally means "this checkbox was not ticked" and the
+    # scope is not applied at all. A scope listed in
+    # `ransackable_scopes_skip_sanitize_args` has asked to see its values as
+    # given, so `false` reaches it like any other value and it can be driven
+    # by a yes / no / any select (#1375).
     def chain_scope(scope, args)
-      return unless @klass.method(scope) && args != false
+      return unless @klass.method(scope)
+      return if args == false && !ransackable_scope_skip_sanitize_args?(scope, @klass)
+
       @object = if scope_arity(scope) < 1 && args == true
                   @object.public_send(scope)
                 elsif scope_arity(scope) == 1 && args.is_a?(Array)
@@ -137,6 +173,8 @@ module Ransack
     end
 
     def association_path(str, base = @base)
+      return ''.freeze unless key_within_depth_limit?(str)
+
       base = klassify(base)
       str ||= ''.freeze
       path = []
@@ -150,6 +188,10 @@ module Ransack
             association_parts.join(Constants::UNDERSCORE)
           )
           next unless found_assoc = get_association(assoc, base)
+          # A polymorphic association is only complete once its
+          # `_of_Model_type` suffix has been consumed; matching on the bare
+          # name would ask the reflection for a class it cannot know (#1557).
+          next if found_assoc.polymorphic? && klass.nil?
           path += association_parts
           association_parts = []
           base = klassify(klass || found_assoc)
@@ -160,27 +202,71 @@ module Ransack
     end
 
     def unpolymorphize_association(str)
-      if (match = str.match(/_of_([^_]+?)_type$/))
-        [match.pre_match, Kernel.const_get(match.captures.first)]
+      if (match = str.match(/_of_([^_]+?)_type$/)) &&
+         (klass = polymorphic_class(match.captures.first))
+        [match.pre_match, klass]
       else
         [str, nil]
       end
     end
 
+    # The class named in an `_of_Model_type` suffix comes from the query
+    # string, so it can name anything: a constant that does not exist, a
+    # lowercase word, a module, a class with no table, a path through
+    # something that is no module at all (`ENV::Person`). None of those is a
+    # model to search, so the suffix is then no polymorphic reference at all
+    # and the whole key fails as any other unknown attribute does, ignored or
+    # raised as `InvalidSearchError` under `ignore_unknown_conditions`.
+    # `Kernel.const_get` used to raise `NameError` straight from the URL
+    # (#1738).
+    def polymorphic_class(name)
+      klass = name.safe_constantize
+      klass if klass.is_a?(Class) && searchable_class?(klass)
+    rescue TypeError
+      # `safe_constantize` swallows a missing constant but not a namespace
+      # that is not a module, which Ruby reports as a TypeError.
+      nil
+    end
+
     def ransackable_alias(str)
       klass._ransack_aliases.fetch(str, klass._ransack_aliases.fetch(str.to_sym, str))
     end
 
+    # Expands every `ransack_alias` in a condition name: the whole name, each
+    # `_or_` / `_and_` segment of a compound, and an alias defined on an
+    # associated model and reached through an association path
+    # (`person_term` when Person aliases `term`). An alias that expands to a
+    # compound is joined with that compound's own combinator, so
+    # `term_or_daddy` with `term => name_or_email` becomes
+    # `name_or_email_or_parent_name`. Returns the name unchanged when it
+    # holds no alias.
+    def resolve_aliases(str)
+      return str.to_s unless key_within_depth_limit?(str)
+
+      whole = resolve_alias_segment(str)
+      return whole if whole != str
+      # A name that is an attribute in its own right is never split, even if
+      # it contains a combinator (a column called `true_or_false`).
+      return str if attribute_method?(str)
+
+      segments = str.split(/_and_|_or_/)
+      resolved = segments.map { |segment| resolve_alias_segment(segment) }
+      return str if resolved == segments
+
+      combinator = str[/_(or|and)_/, 1] || Constants::OR
+      resolved.join("_#{combinator}_")
+    end
+
     def ransackable_attribute?(str, klass)
-      klass.ransackable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym }
+      attributes_for(klass).any? { |s| s.to_sym == str.to_sym }
     end
 
     def ransortable_attribute?(str, klass)
-      klass.ransortable_attributes(auth_object).any? { |s| s.to_sym == str.to_sym }
+      sortable_attributes_for(klass).any? { |s| s.to_sym == str.to_sym }
     end
 
     def ransackable_association?(str, klass)
-      klass.ransackable_associations(auth_object).any? { |s| s.to_sym == str.to_sym }
+      associations_for(klass).any? { |s| s.to_sym == str.to_sym }
     end
 
     def ransackable_scope?(str, klass)
@@ -192,19 +278,68 @@ module Ransack
     end
 
     def searchable_attributes(str = ''.freeze)
-      traverse(str).ransackable_attributes(auth_object)
+      attributes_for(traverse(str))
     end
 
     def sortable_attributes(str = ''.freeze)
-      traverse(str).ransortable_attributes(auth_object)
+      sortable_attributes_for(traverse(str))
     end
 
     def searchable_associations(str = ''.freeze)
-      traverse(str).ransackable_associations(auth_object)
+      associations_for(traverse(str))
     end
 
     private
 
+    def attributes_for(klass)
+      allowlist(klass, :ransackable_attributes) { klass.authorizable_ransackable_attributes }
+    end
+
+    # `ransortable_attributes` defaults to `ransackable_attributes`, so a
+    # model that defines either one has a sort list of its own.
+    def sortable_attributes_for(klass)
+      allowlist(klass, :ransortable_attributes, :ransackable_attributes) do
+        klass.authorizable_ransackable_attributes
+      end
+    end
+
+    def associations_for(klass)
+      allowlist(klass, :ransackable_associations) { klass.authorizable_ransackable_associations }
+    end
+
+    # The allowlist a search consults on `klass`. A model that defines its
+    # own `method` is always asked, so its list applies on top of whatever
+    # the controller permitted. A model that defines none has left the
+    # decision to the controller: when the parameters were permitted, the
+    # block's list of everything that exists is used, and otherwise the
+    # model's default runs, which raises asking for a list (#1403).
+    def allowlist(klass, method, *fallbacks)
+      if permitted && [method, *fallbacks].none? { |m| klass.ransackable_list_defined?(m) }
+        yield
+      else
+        klass.public_send(method, auth_object)
+      end
+    end
+
+    def resolve_alias_segment(segment)
+      target = ransackable_alias(segment)
+      return target if target != segment
+
+      path = association_path(segment)
+      return segment if path.blank?
+
+      remainder = segment.delete_prefix("#{path}_")
+      associated = traverse(path)
+      target = associated._ransack_aliases.fetch(remainder, associated._ransack_aliases.fetch(remainder.to_sym, remainder))
+      return segment if target == remainder
+      # The target may itself be one attribute whose name contains a
+      # combinator (`terms_and_conditions`); it is prefixed whole.
+      return "#{path}_#{target}" if ransackable_attribute?(target, associated)
+
+      # Prefix every attribute of the alias's target with the path.
+      target.gsub(/(\A|_and_|_or_)/) { "#{$1}#{path}_" }
+    end
+
     def cast_scope_args(args)
       if args.is_a?(Array)
         args = args.map(&method(:cast_scope_args))

data/lib/ransack/helpers/form_builder.rb

@@ -112,7 +112,6 @@ module Ransack
 
       def predicate_select(options = {}, html_options = {})
         options[:compounds] = true if options[:compounds].nil?
-        options[:selected] ||= nil
         default = options.delete(:default) || Constants::CONT
 
         keys =
@@ -134,6 +133,7 @@ module Ransack
         collection = keys.map { |k| [k, Translate.predicate(k)] }
         object.predicate ||= Predicate.named(default) if
           can_use_default?(default, :predicate, keys)
+        options[:selected] = selected_predicate unless options.key?(:selected)
         template_collection_select(:p, collection, options, html_options)
       end
 
@@ -144,17 +144,25 @@ module Ransack
 
       private
 
+      # Rails reads a select's current value back through the field name, which
+      # for the predicate select is +p+. Only a Condition has a public +p+, and
+      # +Kernel#p+ is private, so a builder for a Search or Grouping would
+      # raise instead of finding nothing. Resolve the value here instead.
+      def selected_predicate
+        object.predicate_name if object.respond_to?(:predicate_name)
+      end
+
       def template_grouped_collection_select(collection, options, html_options)
         @template.grouped_collection_select(
           @object_name, :name, collection, :last, :first, :first, :last,
-          objectify_options(options), @default_options.merge(html_options)
+          objectify_options(options), @default_html_options.merge(html_options)
           )
       end
 
       def template_collection_select(name, collection, options, html_options)
         @template.collection_select(
           @object_name, name, collection, :first, :last,
-          objectify_options(options), @default_options.merge(html_options)
+          objectify_options(options), @default_html_options.merge(html_options)
           )
       end
 
@@ -188,31 +196,28 @@ module Ransack
         end
       end
 
+      # Expands the +associations:+ option of +attribute_select+ into the flat
+      # list of association paths ransack understands. A String or Symbol
+      # names one association; an Array lists several; a Hash reaches through
+      # an association to its own associations, so +{ articles: :comments }+
+      # yields +articles+ and +articles_comments+. Shapes nest freely.
       def association_array(obj, prefix = nil)
-        ([prefix] + association_object(obj))
-        .compact
-        .flat_map { |v| [prefix, v].compact.join(Constants::UNDERSCORE) }
-      end
-
-      def association_object(obj)
-        case obj
-        when Array
-          obj
-        when Hash
-          association_hash(obj)
-        else
-          [obj]
-        end
-      end
-
-      def association_hash(obj)
-        obj.map do |key, value|
-          case value
-          when Array, Hash
-            association_array(value, key.to_s)
+        Array.wrap(obj).flat_map do |item|
+          case item
+          when Hash
+            association_hash(item, prefix)
+          when nil
+            []
           else
-            [key.to_s, [key, value].join(Constants::UNDERSCORE)]
+            [[prefix, item].compact.join(Constants::UNDERSCORE)]
           end
+        end.uniq
+      end
+
+      def association_hash(obj, prefix = nil)
+        obj.flat_map do |key, value|
+          path = [prefix, key].compact.join(Constants::UNDERSCORE)
+          [path] + association_array(value, path)
         end
       end
 

data/lib/ransack/nodes/bindable.rb

@@ -44,7 +44,6 @@ module Ransack
       end
 
       def is_alias_attribute?
-        Ransack::SUPPORTS_ATTRIBUTE_ALIAS &&
         parent.base_klass.attribute_aliases.key?(attr_name)
       end
     end