sequel 3.48.0 → 4.0.0

data/doc/security.rdoc

@@ -18,11 +18,8 @@ could conceivably be abused to do so:
 
 * Sequel::Schema::CreateTableGenerator.add_type_method
 * Sequel::Dataset.def_mutation_method
-* Sequel::Dataset.def_append_methods
 * Sequel::Model::Plugins.def_dataset_methods
 * Sequel.def_adapter_method (private)
-* Sequel::Model::InstanceMethods.class_attr_overridable (private)
-* Sequel::Model::InstanceMethods.class_attr_reader (private)
 * Sequel::SQL::Expression.to_s_method (private)
 * Sequel::Plugins::HookClassMethods::ClassMethods#add_hook_type
 
@@ -250,31 +247,6 @@ Then you have a denial of service vulnerability.  In general, such a vulnerabili
 is unlikely, because you are probably indexing into the returned hash(es) by name,
 and if an alias was used and you didn't expect it, your application wouldn't work.
 
-The more insidious cases are those where an explicit alias is not used at all, but
-an unaliased expression is used and the database chooses which alias to use.  For
-example, on SQLite, the following types of queries are vulnerable to denial of service:
-
-  DB[:table].get(params[:a].to_s)
-  DB[:table].select_map(params[:b].to_s)
-  DB[:table].select_order_map(params[:c].to_s)
-
-In these cases, the queries will work correctly, but an unused symbol will be created.
-To protect against the denial of service, use an explicit alias:
-
-  DB[:table].get(Sequel.as(params[:a].to_s, :a))
-  DB[:table].select_map(Sequel.as(params[:b].to_s, :a))
-  DB[:table].select_order_map(Sequel.as(params[:c].to_s, :a))
-
-While the above code is unlikely to be used in practice, variants that use expressions
-could be.  For example, if you want to select all values in a specific column, with
-a suffix provided by the user:
-
-  DB[:table].select_map(Sequel.join(:column, params[:suffix].to_s))
-
-As above, you should use an explicit alias to protect against denial of service:
-
-  DB[:table].select_map(Sequel.join(:column, params[:suffix].to_s).as(:a))
-
 === Database Connection Options
 
 All database connection options are converted to symbols.  For a

data/doc/testing.rdoc

@@ -136,6 +136,10 @@ The +spec+ rake task (which is also the default rake task) runs Sequel's core an
 
 The +spec_plugin+ rake task runs the specs for the plugins and extensions that ship with Sequel.  These also use a mocked database connection, and operate very similarly to the general Sequel core and model specs.
 
+== rake spec_core_ext
+
+The +spec_core_ext+ rake task runs the specs for the core_extensions extension.  These are run separately from the other extension tests to make sure none of the other extensions require the core_extensions.
+
 == rake spec_bin
 
 The +spec_bin+ rake task runs the specs for bin/sequel.  These use an SQLite3 database, and require either the sqlite3 (non-JRuby) or jdbc-sqlite3 (JRuby) gem.
@@ -154,20 +158,10 @@ Sequel does not create test databases automatically, except for file-based datab
 
 === Connection Strings
 
-The following environment variables specify Database connection URL strings:
-
-* SEQUEL_INTEGRATION_URL: integration specs
-* SEQUEL_FB_SPEC_DB: firebird adapter specs
-* SEQUEL_MSSQL_SPEC_DB: mssql adapter specs
-* SEQUEL_PG_SPEC_DB: postgres adapter specs
-* SEQUEL_SQLITE_SPEC_DB: sqlite adapter specs
-* SEQUEL_MY_SPEC_DB: mysql adapter specs
-* SEQUEL_DB2_SPEC_DB: db2 adapter specs
+The SEQUEL_INTEGRATION_URL environment variable specifies the Database connection URL to use for the adapter and integration specs.  Additionally, when running the adapter specs, you can also use the SEQUEL_<i>ADAPTER</i>_URL environment variable (e.g. SEQUEL_POSTGRES_URL for spec_postgres).
 
 === Other
 
-* SEQUEL_MSSQL_SPEC_REQUIRE: Separate file to require when running mssql adapter specs
-* SEQUEL_DB2_SPEC_REQUIRE: Separate file to require when running db2 adapter specs
-* SEQUEL_COLUMNS_INTROSPECTION: Whether to run the specs with the columns_introspection extension loaded by default
-* SEQUEL_NO_PENDING: Don't mark any specs as pending, try running all specs
-* SKIPPED_TEST_WARN: Warn when skipping any tests because libraries aren't available
+SEQUEL_COLUMNS_INTROSPECTION :: Whether to run the specs with the columns_introspection extension loaded by default
+SEQUEL_NO_PENDING :: Don't mark any specs as pending, try running all specs
+SKIPPED_TEST_WARN :: Warn when skipping any tests because libraries aren't available

data/lib/sequel/adapters/ado.rb

@@ -45,12 +45,12 @@ module Sequel
       end
 
       # Just execute so it doesn't attempt to return the number of rows modified.
-      def execute_ddl(sql, opts={})
+      def execute_ddl(sql, opts=OPTS)
         execute(sql, opts)
       end
 
       # Just execute so it doesn't attempt to return the number of rows modified.
-      def execute_insert(sql, opts={})
+      def execute_insert(sql, opts=OPTS)
         execute(sql, opts)
       end
       
@@ -58,7 +58,7 @@ module Sequel
       # unless is a provider is in use (since some providers don't seem to
       # return the number of affected rows, but the default provider appears
       # to).
-      def execute_dui(sql, opts={})
+      def execute_dui(sql, opts=OPTS)
         return super if opts[:provider]
         synchronize(opts[:server]) do |conn|
           begin
@@ -70,7 +70,7 @@ module Sequel
         end
       end
 
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         synchronize(opts[:server]) do |conn|
           begin
             r = log_yield(sql){conn.Execute(sql)}
@@ -81,10 +81,6 @@ module Sequel
         end
         nil
       end
-      def do(*a, &block)
-        Sequel::Deprecation.deprecate('Database#do', 'Please use Database#execute')
-        execute(*a, &block)
-      end
 
       private
       
@@ -110,11 +106,11 @@ module Sequel
       # The ADO adapter's default provider doesn't support transactions, since it 
       # creates a new native connection for each query.  So Sequel only attempts
       # to use transactions if an explicit :provider is given.
-      def begin_transaction(conn, opts={})
+      def begin_transaction(conn, opts=OPTS)
         super if @opts[:provider]
       end
 
-      def commit_transaction(conn, opts={})
+      def commit_transaction(conn, opts=OPTS)
         super if @opts[:provider]
       end
 
@@ -126,7 +122,7 @@ module Sequel
         super || (e.is_a?(::WIN32OLERuntimeError) && e.message =~ DISCONNECT_ERROR_RE)
       end
 
-      def rollback_transaction(conn, opts={})
+      def rollback_transaction(conn, opts=OPTS)
         super if @opts[:provider]
       end
     end

data/lib/sequel/adapters/ado/access.rb

@@ -106,7 +106,7 @@ module Sequel
           super
         end
 
-        def execute_insert(sql, opts={})
+        def execute_insert(sql, opts=OPTS)
           synchronize(opts[:server]) do |conn|
             begin
               r = log_yield(sql){conn.Execute(sql)}
@@ -119,18 +119,18 @@ module Sequel
           nil
         end
 
-        def tables(opts={})
+        def tables(opts=OPTS)
           m = output_identifier_meth
           ado_schema_tables.map {|tbl| m.call(tbl['TABLE_NAME'])}
         end
 
-        def views(opts={})
+        def views(opts=OPTS)
           m = output_identifier_meth
           ado_schema_views.map {|tbl| m.call(tbl['TABLE_NAME'])}
         end
         
         # Note OpenSchema returns compound indexes as multiple rows
-        def indexes(table_name,opts={})
+        def indexes(table_name,opts=OPTS)
           m = output_identifier_meth
           idxs = ado_schema_indexes(table_name).inject({}) do |memo, idx|
             unless idx["PRIMARY_KEY"]
@@ -145,7 +145,7 @@ module Sequel
         end
 
         # Note OpenSchema returns compound foreign key relationships as multiple rows
-        def foreign_key_list(table, opts={})
+        def foreign_key_list(table, opts=OPTS)
           m = output_identifier_meth
           fks = ado_schema_foreign_keys(table).inject({}) do |memo, fk|
             name = m.call(fk['FK_NAME'])
@@ -200,15 +200,15 @@ module Sequel
           end
         end
 
-        def begin_transaction(conn, opts={})
+        def begin_transaction(conn, opts=OPTS)
           log_yield('Transaction.begin'){conn.BeginTrans}
         end
           
-        def commit_transaction(conn, opts={})
+        def commit_transaction(conn, opts=OPTS)
           log_yield('Transaction.commit'){conn.CommitTrans}
         end
           
-        def rollback_transaction(conn, opts={})
+        def rollback_transaction(conn, opts=OPTS)
           log_yield('Transaction.rollback'){conn.RollbackTrans}
         end
           

data/lib/sequel/adapters/ado/mssql.rb

@@ -15,7 +15,7 @@ module Sequel
         # Issue a separate query to get the rows modified.  ADO appears to
         # use pass by reference with an integer variable, which is obviously
         # not supported directly in ruby, and I'm not aware of a workaround.
-        def execute_dui(sql, opts={})
+        def execute_dui(sql, opts=OPTS)
           return super unless @opts[:provider]
           synchronize(opts[:server]) do |conn|
             begin
@@ -33,15 +33,15 @@ module Sequel
         # The ADO adapter's default provider doesn't support transactions, since it 
         # creates a new native connection for each query.  So Sequel only attempts
         # to use transactions if an explicit :provider is given.
-        def begin_transaction(conn, opts={})
+        def begin_transaction(conn, opts=OPTS)
           super if @opts[:provider]
         end
 
-        def commit_transaction(conn, opts={})
+        def commit_transaction(conn, opts=OPTS)
           super if @opts[:provider]
         end
 
-        def rollback_transaction(conn, opts={})
+        def rollback_transaction(conn, opts=OPTS)
           super if @opts[:provider]
         end
       end

data/lib/sequel/adapters/amalgalite.rb

@@ -89,23 +89,23 @@ module Sequel
       end
 
       # Run the given SQL with the given arguments. Returns nil.
-      def execute_ddl(sql, opts={})
+      def execute_ddl(sql, opts=OPTS)
         _execute(sql, opts){|conn| log_yield(sql){conn.execute_batch(sql)}}
         nil
       end
       
       # Run the given SQL with the given arguments and return the number of changed rows.
-      def execute_dui(sql, opts={})
+      def execute_dui(sql, opts=OPTS)
         _execute(sql, opts){|conn| log_yield(sql){conn.execute_batch(sql)}; conn.row_changes}
       end
       
       # Run the given SQL with the given arguments and return the last inserted row id.
-      def execute_insert(sql, opts={})
+      def execute_insert(sql, opts=OPTS)
         _execute(sql, opts){|conn| log_yield(sql){conn.execute_batch(sql)}; conn.last_insert_rowid}
       end
       
       # Run the given SQL with the given arguments and yield each row.
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         _execute(sql, opts) do |conn|
           begin
             yield(stmt = log_yield(sql){conn.prepare(sql)})
@@ -116,7 +116,7 @@ module Sequel
       end
       
       # Run the given SQL with the given arguments and return the first value of the first row.
-      def single_value(sql, opts={})
+      def single_value(sql, opts=OPTS)
         _execute(sql, opts){|conn| log_yield(sql){conn.first_value_from(sql)}}
       end
       
@@ -172,7 +172,7 @@ module Sequel
       
       # Quote the string using the adapter instance method.
       def literal_string_append(sql, v)
-        db.synchronize{|c| sql << c.quote(v)}
+        db.synchronize(@opts[:server]){|c| sql << c.quote(v)}
       end
     end
   end

data/lib/sequel/adapters/cubrid.rb

@@ -34,7 +34,7 @@ module Sequel
         @server_version ||= synchronize{|c| c.server_version}
       end
       
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         synchronize(opts[:server]) do |conn|
           r = log_yield(sql) do
             begin
@@ -75,25 +75,25 @@ module Sequel
         end
       end
 
-      def execute_ddl(sql, opts={})
+      def execute_ddl(sql, opts=OPTS)
         execute(sql, opts.merge(:type=>:ddl))
       end
 
-      def execute_dui(sql, opts={})
+      def execute_dui(sql, opts=OPTS)
         execute(sql, opts.merge(:type=>:dui))
       end
 
-      def execute_insert(sql, opts={})
+      def execute_insert(sql, opts=OPTS)
         execute(sql, opts.merge(:type=>:insert))
       end
 
       private
 
-      def begin_transaction(conn, opts={})
+      def begin_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_BEGIN){conn.auto_commit = false}
       end
       
-      def commit_transaction(conn, opts={})
+      def commit_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_COMMIT){conn.commit}
       end
 
@@ -109,7 +109,7 @@ module Sequel
       
       # This doesn't actually work, as the cubrid ruby driver
       # does not implement transactions correctly.
-      def rollback_transaction(conn, opts={})
+      def rollback_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_ROLLBACK){conn.rollback}
       end
     end

data/lib/sequel/adapters/db2.rb

@@ -56,15 +56,11 @@ module Sequel
         DB2CLI.SQLFreeHandle(DB2CLI::SQL_HANDLE_DBC, conn)
       end
 
-      def execute(sql, opts={}, &block)
+      def execute(sql, opts=OPTS, &block)
         synchronize(opts[:server]){|conn| log_connection_execute(conn, sql, &block)}
       end
-      def do(*a, &block)
-        Sequel::Deprecation.deprecate('Database#do', 'Please use Database#execute')
-        execute(*a, &block)
-      end
 
-      def execute_insert(sql, opts={})
+      def execute_insert(sql, opts=OPTS)
         synchronize(opts[:server]) do |conn|
           log_connection_execute(conn, sql)
           sql = "SELECT IDENTITY_VAL_LOCAL() FROM SYSIBM.SYSDUMMY1"
@@ -122,7 +118,7 @@ module Sequel
         [DB2Error]
       end
 
-      def begin_transaction(conn, opts={})
+      def begin_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_BEGIN){DB2CLI.SQLSetConnectAttr(conn, DB2CLI::SQL_ATTR_AUTOCOMMIT, DB2CLI::SQL_AUTOCOMMIT_OFF)}
         set_transaction_isolation(conn, opts)
       end
@@ -133,11 +129,11 @@ module Sequel
         super
       end
 
-      def rollback_transaction(conn, opts={})
+      def rollback_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_ROLLBACK){DB2CLI.SQLEndTran(DB2CLI::SQL_HANDLE_DBC, conn, DB2CLI::SQL_ROLLBACK)}
       end
 
-      def commit_transaction(conn, opts={})
+      def commit_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_COMMIT){DB2CLI.SQLEndTran(DB2CLI::SQL_HANDLE_DBC, conn, DB2CLI::SQL_COMMIT)}
       end
     

data/lib/sequel/adapters/dbi.rb

@@ -53,7 +53,7 @@ module Sequel
         c.disconnect
       end
       
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         synchronize(opts[:server]) do |conn|
           r = log_yield(sql){conn.execute(sql)}
           yield(r) if block_given?
@@ -61,13 +61,9 @@ module Sequel
         end
       end
       
-      def execute_dui(sql, opts={})
+      def execute_dui(sql, opts=OPTS)
         synchronize(opts[:server]){|conn| log_yield(sql){conn.do(sql)}}
       end
-      def do(*a, &block)
-        Sequel::Deprecation.deprecate('Database#do', 'Please use Database#execute_dui')
-        execute_dui(*a, &block)
-      end
 
       private
 

data/lib/sequel/adapters/do.rb

@@ -58,7 +58,7 @@ module Sequel
       # a SELECT statement is being used (or something else that returns rows).
       # Otherwise, the return value is the insert id if opts[:type] is :insert,
       # or the number of affected rows, otherwise.
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         synchronize(opts[:server]) do |conn|
           begin
             command = conn.create_command(sql)
@@ -82,13 +82,13 @@ module Sequel
       
       # Execute the SQL on the this database, returning the number of affected
       # rows.
-      def execute_dui(sql, opts={})
+      def execute_dui(sql, opts=OPTS)
         execute(sql, opts)
       end
       
       # Execute the SQL on this database, returning the primary key of the
       # table being inserted to.
-      def execute_insert(sql, opts={})
+      def execute_insert(sql, opts=OPTS)
         execute(sql, opts.merge(:type=>:insert))
       end
       
@@ -100,7 +100,7 @@ module Sequel
       
       # Return the DataObjects URI for the Sequel URI, removing the do:
       # prefix.
-      def uri(opts={})
+      def uri(opts=OPTS)
         opts = @opts.merge(opts)
         (opts[:uri] || opts[:url]).sub(/\Ado:/, '')
       end

data/lib/sequel/adapters/firebird.rb

@@ -29,7 +29,7 @@ module Sequel
         end
       end
 
-      def execute(sql, opts={})
+      def execute(sql, opts=OPTS)
         begin
           synchronize(opts[:server]) do |conn|
             if conn.transaction_started && !_trans(conn)
@@ -52,7 +52,7 @@ module Sequel
         @primary_keys = {}
       end
 
-      def begin_transaction(conn, opts={})
+      def begin_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_BEGIN) do
           begin
             conn.transaction
@@ -63,7 +63,7 @@ module Sequel
         end
       end
 
-      def commit_transaction(conn, opts={})
+      def commit_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_COMMIT){conn.commit}
       end
       
@@ -71,7 +71,7 @@ module Sequel
         [Fb::Error]
       end
 
-      def rollback_transaction(conn, opts={})
+      def rollback_transaction(conn, opts=OPTS)
         log_yield(TRANSACTION_ROLLBACK){conn.rollback}
       end
     end