restful_query 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6f782db244df437f5e1653556e54f629a2e7b1b6
-  data.tar.gz: eb3fd20c0dde5cee15037b3b8ef220257d6e6329
+  metadata.gz: 25b42eb97b49dbc1d08d730ad29113a888033813
+  data.tar.gz: 11d809dc510245c2932677df4115d077f6d8c2a7
 SHA512:
-  metadata.gz: 62fde767dcb820a0539c1e163fcf59b628e8c94a63b4f0c177d5f2165d85411b82bfe5d4a4730c53fcc1e85146663e087c8aea349e6d581ea8bae13efdd56e58
-  data.tar.gz: fcca5416bbba463353a99f87fe7af42b567f933da4ea2d61a0b1458e92e6124052fde6b8ae93367c245858454c96e6d21a7062070790c7e464175be702b0ba61
+  metadata.gz: 8bbe7feccab43431afd22e87a04b89c2c6d223ebe16804ff3389228be9f9ef5b78a11a4788a1d3b407000d4e56cb304e02ce6df7929f60710f3f2bdfde1fd074
+  data.tar.gz: f37c120c774a0d580944f1a04c9dd604e2919d8745073c9fc5679b4a8dc833c76d789a2b54be692efa8a24481ef8f64643cc8bcbd06b4f59b0319d48bc7d624d

data/.travis.yml

@@ -0,0 +1,6 @@
+language: ruby
+rvm:
+  - 1.9.3
+  - 2.0.0
+  - 2.1
+  - 2.2

data/History.txt

@@ -1,3 +1,7 @@
+== 0.5.0 2015-10-07
+
+* Security Release: Fix for improperly escaped columns, could cause potential SQL injection attack depending on what params were being passed to restful query
+
 == 0.3.5 2011-08-15
 
 * Too quick to release the last one. Fixed now.

data/lib/restful_query.rb

@@ -5,7 +5,7 @@ require "active_support"
 require "chronic"
 
 module RestfulQuery
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 
   class Error < RuntimeError; end
 end

data/lib/restful_query/condition.rb

@@ -2,7 +2,7 @@ module RestfulQuery
   class InvalidOperator < Error; end;
   
   class Condition
-    attr_reader :column, :value, :operator, :options
+    attr_reader :value, :operator, :options
     
     OPERATOR_MAPPING = {
       'lt'    => '<',
@@ -80,6 +80,10 @@ module RestfulQuery
     def to_condition_array
       ["#{column} #{operator} #{placeholder}", value]
     end
+
+    def column
+      ActiveRecord::Base.connection.quote_column_name(@column)
+    end
     
     def placeholder
       if ['IN', 'NOT IN'].include?(operator)

data/lib/sequel/extensions/restful_query.rb

@@ -8,6 +8,12 @@ module RestfulQuery
     end
     
   end
+
+  class Condition
+    def column
+      DB.quote_identifier(@column)
+    end
+  end
 end
 
 module Sequel

data/restful_query.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: restful_query 0.4.0 ruby lib
+# stub: restful_query 0.5.0 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "restful_query"
-  s.version = "0.4.0"
+  s.version = "0.5.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Aaron Quint"]
-  s.date = "2015-02-27"
+  s.date = "2015-10-07"
   s.description = "RestfulQuery provides a simple interface in front of a complex parser to parse specially formatted query hashes into complex SQL queries. It includes ActiveRecord and Sequel extensions."
   s.email = "aaron@quirkey.com"
   s.extra_rdoc_files = [
@@ -19,6 +19,7 @@ Gem::Specification.new do |s|
     "README.rdoc"
   ]
   s.files = [
+    ".travis.yml",
     "Appraisals",
     "Gemfile",
     "History.txt",
@@ -43,7 +44,7 @@ Gem::Specification.new do |s|
   ]
   s.homepage = "https://github.com/quirkey/restful_query"
   s.licenses = ["MIT"]
-  s.rubygems_version = "2.2.2"
+  s.rubygems_version = "2.4.5"
   s.summary = "Simple ActiveRecord and Sequel queries from a RESTful and safe interface"
 
   if s.respond_to? :specification_version then

data/test/condition_test.rb

@@ -11,7 +11,7 @@ class RestfulQuery::ConditionTest < Minitest::Test
         end
 
         should "save column" do
-          assert_equal 'created_at', @condition.column
+          assert_equal "'created_at'", @condition.column
         end
 
         should "save value" do
@@ -104,7 +104,7 @@ class RestfulQuery::ConditionTest < Minitest::Test
         end
 
         should "include parens in placeholder" do
-          assert_equal ["year IN (?)", ['1995', '2005', '2006']], @condition.to_condition_array
+          assert_equal ["'year' IN (?)", ['1995', '2005', '2006']], @condition.to_condition_array
         end
 
         context "when the value is already an array" do
@@ -150,7 +150,7 @@ class RestfulQuery::ConditionTest < Minitest::Test
         end
 
         should "translate operator to LIKE" do
-          assert_equal("title LIKE ?", @to_condition_array[0])
+          assert_equal("'title' LIKE ?", @to_condition_array[0])
         end
 
       end
@@ -165,7 +165,7 @@ class RestfulQuery::ConditionTest < Minitest::Test
         end
 
         should "have conditional string first" do
-          assert_equal 'title < ?', @to_condition[0]
+          assert_equal "'title' < ?", @to_condition[0]
         end
 
         should "have value as [1]" do
@@ -175,7 +175,17 @@ class RestfulQuery::ConditionTest < Minitest::Test
 
       context "to_hash" do
         should "return hash like params" do
-          assert_equal({'title' => {'lt' => 'Bossman'}}, @condition.to_hash)
+          assert_equal({"'title'" => {'lt' => 'Bossman'}}, @condition.to_hash)
+        end
+      end
+
+      context "invalid Condition" do
+        setup do
+          @condition = RestfulQuery::Condition.new('title\'invalid', 'Bossman', 'lt')
+        end
+
+        should "escape column name" do
+          assert_equal("'title''invalid' < ?", @condition.to_condition_array[0])
         end
       end
     end

data/test/helper.rb

@@ -19,11 +19,21 @@ unless defined?(ActiveRecord)
 
         def named_scope(name, options = {})
         end
+
+        def connection
+          PGAdapter.new
+        end
       end
       self.pluralize_table_names = true
 
       include RestfulQuery::CanQuery
     end
+
+    class PGAdapter
+      def quote_column_name(column_name)
+        "'" + column_name.to_s.gsub(/'/, "''") + "'"
+      end
+    end
   end
 end
 

data/test/parser_test.rb

@@ -163,7 +163,7 @@ class RestfulQuery::ParserTest < Minitest::Test
 
         should "map condition column" do
           assert @parser.conditions_for('section')
-          assert_equal 'section_id', @parser.conditions_for('section').first.column
+          assert_equal "'section_id'", @parser.conditions_for('section').first.column
         end
 
         should "map sort column" do
@@ -329,7 +329,7 @@ class RestfulQuery::ParserTest < Minitest::Test
           assert @conditions.is_a?(Array)
           @conditions.each do |condition|
             assert condition.is_a?(RestfulQuery::Condition)
-            assert_equal 'created_at', condition.column
+            assert_equal "'created_at'", condition.column
           end
         end
 
@@ -349,7 +349,7 @@ class RestfulQuery::ParserTest < Minitest::Test
         end
 
         should "include operators for all querys" do
-          assert_match(/(([a-z_]) (\<|\>|\=|\<\=|\>\=) \? AND)+/,@conditions[0])
+          assert_match(/(([a-z_']) (\<|\>|\=|\<\=|\>\=) \? AND)+/,@conditions[0])
         end
 
         should "join query hash with AND" do
@@ -368,7 +368,7 @@ class RestfulQuery::ParserTest < Minitest::Test
         end
 
         should "join query hash with OR" do
-          assert_match(/(([a-z_]) (\<|\>|\=|\<\=|\>\=) \? OR)+/,@conditions[0])
+          assert_match(/(([a-z_']) (\<|\>|\=|\<\=|\>\=) \? OR)+/,@conditions[0])
         end
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: restful_query
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Aaron Quint
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-27 00:00:00.000000000 Z
+date: 2015-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -110,6 +110,7 @@ extra_rdoc_files:
 - LICENSE
 - README.rdoc
 files:
+- ".travis.yml"
 - Appraisals
 - Gemfile
 - History.txt
@@ -151,7 +152,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Simple ActiveRecord and Sequel queries from a RESTful and safe interface