ransack 5.0.1 → 6.0.0

data/lib/ransack/nodes/condition.rb

@@ -9,6 +9,18 @@ module Ransack
 
       attr_accessor :predicate
 
+      # The effective null sentinel, captured when the condition is built. A
+      # Context can be shared by several searches, each with its own
+      # per-search override; reading the context lazily at SQL generation or
+      # form rendering time would let a later search's setting rewrite an
+      # earlier search's conditions.
+      attr_reader :null_sentinel
+
+      def initialize(context)
+        super
+        @null_sentinel = context&.null_sentinel
+      end
+
       class << self
         def extract(context, key, values)
           attributes, predicate, combinator =
@@ -24,7 +36,7 @@ module Ransack
             )
             # TODO: Figure out what to do with multiple types of attributes,
             # if anything. Tempted to go with "garbage in, garbage out" here.
-            if predicate.validate(condition.values, condition.default_type)
+            if predicate.validate(condition.values, condition.default_type, condition.null_sentinel)
               condition
             else
               nil
@@ -44,29 +56,41 @@ module Ransack
             end
 
             if context.present?
-              str = context.ransackable_alias(str)
-            end
-
-            combinator =
-            if str.match(/_(or|and)_/)
-              $1
-            else
-              nil
+              str = context.resolve_aliases(str)
             end
 
+            # A name that is an attribute in its own right is never split,
+            # whatever it contains.
             if context.present? && context.attribute_method?(str)
               attributes = [str]
+              combinator = nil
             else
+              combinator = combinator_in(str, context)
               attributes = str.split(/_and_|_or_/)
             end
 
             [attributes, predicate, combinator]
           end
+
+          # A condition name carries one combinator: `a_or_b_or_c` or
+          # `a_and_b`. There is no grammar for precedence between the two,
+          # so a name using both is rejected under a strict search rather
+          # than silently applying whichever came first to every attribute
+          # (#1019). Mixed logic is what groupings are for.
+          def combinator_in(str, context)
+            combinators = str.scan(/_(or|and)_/).flatten.uniq
+            if combinators.size > 1 && context&.strict_conditions?
+              raise InvalidSearchError,
+                "Mixed combinators in #{str}: a condition name may use " \
+                "_and_ or _or_ but not both; use groupings for mixed logic"
+            end
+            combinators.first
+          end
       end
 
       def valid?
         attributes.detect(&:valid?) && predicate && valid_arity? &&
-          predicate.validate(values, default_type) && valid_combinator?
+          predicate.validate(values, default_type, null_sentinel) && valid_combinator?
       end
 
       def valid_arity?
@@ -84,14 +108,14 @@ module Ransack
           args.each do |attr|
             if attr.is_a?(Hash) && (attr.key?(:name) || attr.key?("name"))
               attr = attr.with_indifferent_access
-              build_attribute(attr[:name], attr[:ransacker_args])
+              build_attributes(attr[:name], attr[:ransacker_args])
             else
-              build_attribute(attr)
+              build_attributes(attr)
             end
           end
         when Hash
           args.each do |index, attrs|
-            build_attribute(attrs[:name], attrs[:ransacker_args])
+            build_attributes(attrs[:name], attrs[:ransacker_args])
           end
         else
           raise ArgumentError,
@@ -126,12 +150,21 @@ module Ransack
       end
       alias :v= :values=
 
+      # A supplied combinator wins; the one an expanded alias carried is the
+      # fallback, so `a: { '0' => { name: 'term' } }` with `term` aliasing
+      # `name_or_email` ORs its two attributes without an `m` in the params.
+      # The fallback covers a missing or blank `m` only: an unknown one that
+      # `Node#combinator=` normalised to nil still fails `valid_combinator?`,
+      # as it does for any other multi-attribute condition.
       def combinator
-        @attributes.size > 1 ? @combinator : nil
+        return nil unless @attributes.size > 1
+
+        @combinator || (@alias_combinator unless @combinator_supplied)
       end
 
       def combinator=(val)
         super
+        @combinator_supplied = !val.to_s.strip.empty?
       end
 
       alias :m= :combinator=
@@ -155,6 +188,25 @@ module Ransack
       #  TODO: Add test coverage for this behavior and ensure that `name.nil?`
       #  isn't fixing issue #701 by introducing untested regressions.
       #
+      # An attribute named in advanced-search params (`a: { '0' => { name:
+      # 'term' } }`) arrives raw, unlike a simple key, which `Condition.extract`
+      # resolves before it gets here. So a `ransack_alias` is expanded here the
+      # same way: an alias to one attribute is built under that name, and an
+      # alias to a compound becomes one attribute per segment, joined by the
+      # compound's combinator (#1728). Left alone, the alias passed `valid?`
+      # by being allowlisted and bound a column that does not exist.
+      def build_attributes(name, ransacker_args = [])
+        return build_attribute(name, ransacker_args) if name.blank? || @context.nil?
+
+        resolved = @context.resolve_aliases(name.to_s)
+        if resolved == name.to_s || @context.attribute_method?(resolved)
+          build_attribute(resolved, ransacker_args)
+        else
+          @alias_combinator = resolved[/_(or|and)_/, 1]
+          resolved.split(/_and_|_or_/).each { |segment| build_attribute(segment, ransacker_args) }
+        end
+      end
+
       def build_attribute(name = nil, ransacker_args = [])
         Attribute.new(@context, name, ransacker_args).tap do |attribute|
           @context.bind(attribute, attribute.name)
@@ -173,22 +225,37 @@ module Ransack
 
       def value
         if predicate.wants_array
-          values.map { |v| v.cast(default_type) }
+          values.map { |v| cast_unless_null_sentinel(v) }
         else
-          values.first.cast(default_type)
+          cast_unless_null_sentinel(values.first)
+        end
+      end
+
+      # Casting the sentinel here would turn it into a real value on a
+      # typed column (e.g. an integer column casts it to 0), so a form
+      # re-rendering this condition's current value would resubmit that
+      # literal instead of the sentinel.
+      def cast_unless_null_sentinel(v)
+        if Constants.null_sentinel_predicate?(predicate.name, null_sentinel) &&
+           Constants.null_sentinel_value?(v.value, null_sentinel)
+          v.value
+        else
+          v.cast(default_type)
         end
       end
 
       # The long spellings route through the short setters: `p=` resolves a
       # Predicate object, whereas the `predicate=` attribute writer would store
-      # the bare name.
+      # the bare name. `predicate_name` is the spelling the ransacker docs
+      # used for years, so it is accepted too (#1009).
       LONG_KEYS = {
-        'attributes' => 'a', 'values' => 'v', 'predicate' => 'p', 'combinator' => 'm'
+        'attributes' => 'a', 'values' => 'v', 'predicate' => 'p',
+        'predicate_name' => 'p', 'combinator' => 'm'
       }.freeze
 
       def build(params)
         params.with_indifferent_access.each do |key, value|
-          if key.match(/^(a|v|p|m|attributes|values|predicate|combinator)$/)
+          if key.match(/^(a|v|p|m|attributes|values|predicate|predicate_name|combinator)$/)
             self.send("#{LONG_KEYS.fetch(key, key)}=", value)
           end
         end
@@ -220,7 +287,7 @@ module Ransack
 
       def predicate_name=(name)
         self.predicate = Predicate.named(name)
-        unless negative?
+        if predicate && !negative?
           attributes.each { |a| context.lock_association(a.parent) }
         end
         @predicate
@@ -233,7 +300,17 @@ module Ransack
       alias :p :predicate_name
 
       def validated_values
-        values.select { |v| predicate.validator.call(v.value) }
+        selected = values.select { |v| predicate.validator.call(v.value) }
+        return selected unless null_sentinel_requested?
+
+        # The sentinel is a marker to detect, never a value to search for
+        # or to cast to the column's type, so it is excluded from the
+        # values #format_predicate builds the ordinary IN/EQ node from.
+        selected.reject { |v| Constants.null_sentinel_value?(v.value, null_sentinel) }
+      end
+
+      def null_sentinel_requested?
+        Constants.null_sentinel_requested?(predicate.name, values, null_sentinel)
       end
 
       def casted_values_for_attribute(attr)
@@ -270,12 +347,18 @@ module Ransack
         end
       end
 
+      # The column (or ransacker expression) a predicate compares against.
+      # A case-insensitive predicate lowers it, unless the dialect has a
+      # case-insensitive LIKE of its own (ILIKE), in which case the lowering
+      # is left to the database. LOWER() is applied as a function rather than
+      # through Arel's Attribute#lower so that a ransacker returning any Arel
+      # node — a SQL literal, an infix operation — is lowered too (#1357).
       def attr_value_for_attribute(attr)
-        return attr.attr if ActiveRecord::Base.adapter_class::ADAPTER_NAME == "PostgreSQL"
-
-        predicate.case_insensitive ? attr.attr.lower : attr.attr
-      rescue
-        attr.attr
+        if predicate.case_insensitive && !context.dialect.case_insensitive_like?
+          Arel::Nodes::NamedFunction.new('LOWER'.freeze, [attr.attr])
+        else
+          attr.attr
+        end
       end
 
       def default_type
@@ -318,7 +401,7 @@ module Ransack
                 Arel::Nodes::NotIn.new(context.primary_key, Arel.sql(query.to_sql))
               end
             when 'not_cont'
-              query.where(attribute.attr.matches(formatted_values_for_attribute(attribute)))
+              query.where(like_predicate(attribute, 'matches'.freeze))
               Arel::Nodes::NotIn.new(context.primary_key, Arel.sql(query.to_sql))
             else
               query.where(format_predicate(attribute).not)
@@ -328,19 +411,6 @@ module Ransack
             format_predicate(attribute)
           end
 
-          # Applied per attribute rather than to the reduced node: once several
-          # attributes are combined, the result is an And/Or whose `right` is
-          # another predicate node rather than a Casted value, so
-          # replace_right_node? returns false and nothing is unwrapped at all.
-          if replace_right_node?(predicate)
-            # Replace right node object to plain integer value in order to avoid
-            # ActiveModel::RangeError from Arel::Node::Casted.
-            # The error can be ignored here because RDBMSs accept large numbers
-            # in condition clauses.
-            plain_value = predicate.right.value
-            predicate.right = plain_value
-          end
-
           predicate
         }.reduce(combinator_method)
       end
@@ -368,26 +438,11 @@ module Ransack
           arel_values = arel_values.reject { |v| v == ''.freeze }
         end
 
-        # For LIKE predicates, wrap the value in Arel::Nodes.build_quoted to prevent
-        # ActiveRecord normalization from affecting wildcard patterns, and pass
-        # the escape character so the escaping done by `escape_wildcards` is
-        # actually honoured. Without an explicit ESCAPE clause, SQLite treats a
-        # backslash as a literal character rather than an escape.
-        # See https://github.com/activerecord-hackery/ransack/issues/1581
         # A length predicate compares LENGTH(column) rather than the column.
         attr_value = length_predicate? ? length_function_for_attribute(attribute) : attr_value_for_attribute(attribute)
 
         if like_predicate?(arel_pred)
-          # The compound forms (matches_any / matches_all and their negations)
-          # iterate over an Array of patterns, so each element is quoted on its
-          # own; wrapping the whole Array in one node would hand them a single
-          # Quoted to iterate over.
-          arel_values = if arel_values.is_a?(Array)
-            arel_values.map { |v| Arel::Nodes.build_quoted(v) }
-          else
-            Arel::Nodes.build_quoted(arel_values)
-          end
-          predicate = attr_value.public_send(arel_pred, arel_values, Constants::LIKE_ESCAPE_CHARACTER)
+          predicate = like_predicate(attribute, arel_pred, arel_values)
         else
           predicate = attr_value.public_send(arel_pred, arel_values)
         end
@@ -398,9 +453,39 @@ module Ransack
           end
         end
 
+        predicate = null_sentinel_requested? ? apply_null_sentinel(predicate, attr_value) : predicate
+
+        # Replace an oversized Casted integer value with the plain integer,
+        # in order to avoid ActiveModel::RangeError from Arel::Node::Casted.
+        # The error can be ignored here because RDBMSs accept large numbers
+        # in condition clauses. Applied recursively rather than only to the
+        # top-level node, because the Casted value can sit inside an In /
+        # NotIn node's `right` Array, or inside the Grouping / And / Or
+        # that Arel's own `_any` / `_all` predicates build. Done here rather
+        # than in #arel_predicate because the negated collection branch there
+        # renders this node to SQL for its correlated subquery straight away,
+        # which is where the Casted value would raise. Runs last so it also
+        # covers the OR grouping the null sentinel may have added.
+        unwrap_oversized_integers(predicate)
+
         predicate
       end
 
+      # `validated_values` has already excluded the sentinel above, so
+      # `predicate` here is built from the real values alone (or, when
+      # the sentinel was the only value submitted, from an empty
+      # array). An empty IN or eq_any/in_any is not `IS NULL` on its
+      # own terms (an empty `IN` is a literal false, and an empty
+      # `eq_any` builds a broken Grouping), so that case is replaced
+      # outright rather than OR'd.
+      def apply_null_sentinel(predicate, attr_value)
+        if validated_values.empty?
+          attr_value.eq(nil)
+        else
+          predicate.or(attr_value.eq(nil))
+        end
+      end
+
       def in_predicate?(predicate)
         return unless defined?(Arel::Nodes::Casted)
         predicate.class == Arel::Nodes::In || predicate.class == Arel::Nodes::NotIn
@@ -415,6 +500,44 @@ module Ransack
         LIKE_PREDICATES.include?(arel_predicate)
       end
 
+      # Builds a LIKE / NOT LIKE node (or the _any / _all forms).
+      #
+      # The value is wrapped in Arel::Nodes.build_quoted so that Active
+      # Record's `normalizes` cannot rewrite the wildcards, and the escape
+      # character is passed so the escaping done by `escape_wildcards` is
+      # honoured: without an explicit ESCAPE clause SQLite treats a backslash
+      # as a literal character (#1581). The compound forms iterate over an
+      # Array of patterns, so each element is quoted on its own.
+      #
+      # Only the `i_` predicates ask for a case-insensitive match. Arel's
+      # PostgreSQL visitor renders a case-sensitive `matches` as LIKE and the
+      # other kind as ILIKE; before 6.0 the flag was never passed and every
+      # LIKE on PostgreSQL became ILIKE (#1421).
+      def like_predicate(attribute, arel_predicate, values = formatted_values_for_attribute(attribute))
+        attr_value = attr_value_for_attribute(attribute)
+        escape = Constants::LIKE_ESCAPE_CHARACTER
+        case_sensitive = !predicate.case_insensitive
+
+        case arel_predicate
+        # Arel's does_not_match_any / _all take no case_sensitive argument,
+        # unlike the other four, so they are assembled here the same way Arel
+        # assembles them.
+        when 'does_not_match_any'.freeze
+          nodes = values.map { |v| attr_value.does_not_match(Arel::Nodes.build_quoted(v), escape, case_sensitive) }
+          Arel::Nodes::Grouping.new(nodes.inject(&:or))
+        when 'does_not_match_all'.freeze
+          nodes = values.map { |v| attr_value.does_not_match(Arel::Nodes.build_quoted(v), escape, case_sensitive) }
+          Arel::Nodes::Grouping.new(Arel::Nodes::And.new(nodes))
+        else
+          quoted = if values.is_a?(Array)
+            values.map { |v| Arel::Nodes.build_quoted(v) }
+          else
+            Arel::Nodes.build_quoted(values)
+          end
+          attr_value.public_send(arel_predicate, quoted, escape, case_sensitive)
+        end
+      end
+
       STRING_LIKE_TYPES = %i[string text citext].freeze
 
       def string_like_attribute?(attribute)
@@ -434,35 +557,54 @@ module Ransack
         end
       end
 
-      def replace_right_node?(predicate)
-        return false unless predicate.is_a?(Arel::Nodes::Binary)
+      # Walks a predicate node for the shapes `#arel_predicate` can produce
+      # (a single Binary, an In/NotIn holding an Array, or several of these
+      # combined with Grouping/And/Or) and replaces each integer Casted
+      # value it finds with the plain integer, in place.
+      def unwrap_oversized_integers(node)
+        case node
+        when Arel::Nodes::Grouping
+          unwrap_oversized_integers(node.expr)
+        when Arel::Nodes::And, Arel::Nodes::Or
+          # Both are Nary: `grouping_any` (behind every `_any` predicate)
+          # builds a single Or with one child per value, not a pairwise
+          # chain, so `left`/`right` alone would miss the third value on.
+          node.children.each { |child| unwrap_oversized_integers(child) }
+        when Arel::Nodes::In, Arel::Nodes::NotIn
+          if node.right.is_a?(Array)
+            node.right = node.right.map { |v| plain_integer(v) || v }
+          else
+            # In / NotIn are Binary subclasses and match before that arm, so a
+            # bare Casted right (not an Array) needs the same handling as one.
+            unwrap_binary_right(node)
+          end
+        when Arel::Nodes::Binary
+          unwrap_binary_right(node)
+        end
+      end
 
-        arel_node = predicate.right
-        return false unless arel_node.is_a?(Arel::Nodes::Casted)
+      def unwrap_binary_right(node)
+        plain_value = plain_integer(node.right)
+        node.right = plain_value if plain_value
+      end
+
+      def plain_integer(arel_node)
+        return nil unless arel_node.is_a?(Arel::Nodes::Casted)
 
         relation, name = arel_node.attribute.values
         attribute_type = relation.type_for_attribute(name).type
-        attribute_type == :integer && arel_node.value.is_a?(Integer)
+        return nil unless attribute_type == :integer && arel_node.value.is_a?(Integer)
+
+        arel_node.value
       end
 
       def length_predicate?
         predicate_name.to_s.start_with?('length_')
       end
 
-      # CHAR_LENGTH counts characters and is the SQL standard spelling; SQLite
-      # has no CHAR_LENGTH and its LENGTH already counts characters for text.
-      CHAR_LENGTH_ADAPTERS = %w[PostgreSQL PostGIS Mysql2 Trilogy].freeze
-
       def length_function_for_attribute(attribute)
-        function_name =
-          if CHAR_LENGTH_ADAPTERS.include?(ActiveRecord::Base.adapter_class::ADAPTER_NAME)
-            'CHAR_LENGTH'.freeze
-          else
-            'LENGTH'.freeze
-          end
-
         Arel::Nodes::NamedFunction.new(
-          function_name,
+          context.dialect.length_function,
           [attr_value_for_attribute(attribute)]
         )
       end

data/lib/ransack/nodes/grouping.rb

@@ -38,15 +38,9 @@ module Ransack
       def conditions=(conditions)
         case conditions
         when Array
-          conditions.each do |attrs|
-            condition = Condition.new(@context).build(attrs)
-            self.conditions << condition if condition.valid?
-          end
+          conditions.each { |attrs| add_condition(attrs) }
         when Hash
-          conditions.each do |index, attrs|
-            condition = Condition.new(@context).build(attrs)
-            self.conditions << condition if condition.valid?
-          end
+          conditions.each_value { |attrs| add_condition(attrs) }
         end
         remove_duplicate_conditions!
       end
@@ -126,7 +120,9 @@ module Ransack
       end
 
       def attribute_method?(name)
-        stripped_name = strip_predicate_and_index(name)
+        return false unless @context.key_within_depth_limit?(name)
+
+        stripped_name = @context.resolve_aliases(strip_predicate_and_index(name))
         return true if @context.attribute_method?(stripped_name) ||
                        @context.attribute_method?(name)
         case stripped_name
@@ -192,7 +188,7 @@ module Ransack
         if self[name].nil?
           stripped_name = name.dup
           predicate = Predicate.detect_and_strip_from_string!(stripped_name)
-          aliased_attribute = context.ransackable_alias(stripped_name)
+          aliased_attribute = context.resolve_aliases(stripped_name)
           name = "#{aliased_attribute}_#{predicate}" unless aliased_attribute == stripped_name
         end
 
@@ -203,12 +199,40 @@ module Ransack
         end
       end
 
+      # Drops a multiparameter index (`created_at(1i)`) and then the predicate
+      # from a key. The index is found by a plain scan. The `/(.+?)\(/` this
+      # replaces let its lazy group re-run from every position of a long key,
+      # which CodeQL reports as polynomial (rb/polynomial-redos); Ruby's engine
+      # short-circuits that in practice, but one pass needs no such help.
       def strip_predicate_and_index(str)
-        string = str[/(.+?)\(/, 1] || str.dup
+        paren = str.index('(')
+        string = paren&.positive? ? str[0...paren] : str.dup
         Predicate.detect_and_strip_from_string!(string)
         string
       end
 
+      # A condition is dropped when it fails validation, as an unknown
+      # attribute or predicate would be. One failure is worth naming: a
+      # single-value predicate given several values. A strict search raises
+      # for it, so the caller learns why the filter vanished (#1724). The
+      # check only applies once the predicate and an attribute have resolved;
+      # a condition that is invalid for another reason keeps its behaviour.
+      def add_condition(attrs)
+        condition = Condition.new(@context).build(attrs)
+        if condition.valid?
+          self.conditions << condition
+        elsif @context.strict_conditions? && arity_failure?(condition)
+          raise InvalidSearchError,
+            "Predicate #{condition.predicate_name} takes a single value, " \
+            "#{condition.values.size} given for #{condition.attributes.map(&:name).join(', ')}"
+        end
+      end
+
+      def arity_failure?(condition)
+        condition.predicate && condition.attributes.any?(&:valid?) &&
+          !condition.valid_arity?
+      end
+
       def remove_duplicate_conditions!
         # If self.conditions.uniq! is called without passing a block, then
         # conditions differing only by ransacker_args within attributes are

data/lib/ransack/nodes/sort.rb

@@ -30,7 +30,7 @@ module Ransack
       end
 
       def name=(name)
-        @name = context.ransackable_alias(name) || name
+        @name = context.resolve_aliases(name.to_s)
         context.bind(self, @name)
       end
 

data/lib/ransack/nodes/value.rb

@@ -61,7 +61,14 @@ module Ransack
           Time.zone.local(*val) rescue nil
         else
           unless val.acts_like?(:time)
-            val = val.is_a?(String) ? Time.zone.parse(val) : val.to_time rescue val
+            val = case val
+                  when String then Time.zone.parse(val)
+                  # A Date means midnight in Time.zone. Date#to_time would
+                  # give midnight in the process's system zone, which then
+                  # shifts by the offset between the two (#1436).
+                  when Date then val.in_time_zone
+                  else val.to_time
+                  end rescue val
           end
           val.in_time_zone rescue nil
         end

data/lib/ransack/predicate.rb

@@ -73,12 +73,19 @@ module Ransack
       end
     end
 
-    def validate(vals, type = @type)
+    def validate(vals, type = @type, sentinel = Ransack.options[:null_sentinel])
       # An explicitly empty array is a meaningful filter (matching nothing)
       # rather than an absent one, but only when blank values are not ignored.
       return true if vals.empty? && wants_array &&
                      !Ransack.options[:ignore_blank_values]
 
+      # The null sentinel is a marker compared by identity, never cast to
+      # the column's type. Casting it here would be the only place it is
+      # cast at all: a cast to :date or :integer turns most strings into
+      # nil, which the validator then rejects, dropping the whole condition
+      # when the sentinel is the only value submitted (#940).
+      return true if Constants.null_sentinel_requested?(name, vals, sentinel)
+
       # When blank values are meaningful, validate the value as given. Casting
       # first would turn '' into nil for an integer or boolean column and the
       # explicit blank would be dropped — leaving no condition at all.