squeel 1.0.2 → 1.0.3

data/CHANGELOG.md

@@ -1,5 +1,11 @@
-# v1.0.2
-## 2012-05-30
+## 1.0.3 (2012-06-07)
+
+* Port fix for Rails CVE-2012-2661 to Squeel.
+* Reduce risk of a potential memory leak through overzealous
+  calling to to_sym.
+* Allow right-hand relation conditions to prevail in Relation#merge.
+
+## 1.0.2 (2012-05-30)
 
 * Add groupings to DSL. Allows control of matched sets of
   parentheses in the absence of not/and/etc. Accessed via
@@ -9,12 +15,10 @@
 * Work around issue with Relation#count when where_values
   contains InfixOperations. Fixes #122.
 
-# v1.0.1
-## 2012-05-02
+## 1.0.1 (2012-05-02)
 
 * Undefine `type` method on Stubs/KeyPaths for 1.8.x compat.
 
-# v1.0.0
-## 2012-04-22
+## 1.0.0 (2012-04-22)
 
 * Official 1.0.0 release.

data/lib/squeel/adapters/active_record/3.0/context.rb

@@ -17,11 +17,11 @@ module Squeel
 
         def find(object, parent = @base)
           if JoinBase === parent
-            object = object.to_sym if String === object
             case object
-            when Symbol, Nodes::Stub
+            when String, Symbol, Nodes::Stub
+              assoc_name = object.to_s
               @object.join_associations.detect { |j|
-                j.reflection.name == object.to_sym && j.parent == parent
+                j.reflection.name.to_s == assoc_name && j.parent == parent
               }
             when Nodes::Join
               @object.join_associations.detect { |j|
@@ -50,7 +50,7 @@ module Squeel
 
         def get_table(object)
           if [Symbol, String, Nodes::Stub].include?(object.class)
-            Arel::Table.new(object.to_sym, :engine => @engine)
+            Arel::Table.new(object.to_s, :engine => @engine)
           elsif Nodes::Join === object
             object._klass ? object._klass.arel_table : Arel::Table.new(object._name, :engine => @engine)
           elsif object.respond_to?(:aliased_table_name)

data/lib/squeel/adapters/active_record/3.0/relation_extensions.rb

@@ -32,38 +32,19 @@ module Squeel
           )
         end
 
-        # We need to be able to support merging two relations that have a different
-        # base class. Stock ActiveRecord doesn't have to do anything too special, because
-        # it's already created predicates out of the where_values by now, and they're
-        # already bound to the proper table.
-        #
-        # Squeel, on the other hand, needs to do its best to ensure the predicates are still
-        # winding up against the proper table. The most "correct" way I can think of to do
-        # this is to try to emulate the default AR behavior -- that is, de-squeelifying
-        # the *_values, erm... values by visiting them and converting them to ARel nodes
-        # before merging. Merging relations is a nifty little trick, but it's another
-        # little corner of ActiveRecord where the magic quickly fades. :(
-        def merge(r)
-          if relation_with_different_base?(r)
-            r = r.clone.visit!
+        # We need to be able to support merging two relations without having
+        # to get our hooks too deeply into ActiveRecord. AR's relation
+        # merge functionality is very cool, but relatively complex, to
+        # handle the various edge cases. Our best shot at avoiding strange
+        # behavior with Squeel loaded is to visit the *_values arrays in
+        # the relations we're merging, and then use the default AR merge
+        # code on the result.
+        def merge(r, relations_visited = false)
+          if relations_visited
+            super(r)
+          else
+            clone.visit!.merge(r.clone.visit!, true)
           end
-
-          super(r)
-        end
-
-        def relation_with_different_base?(r)
-          ::ActiveRecord::Relation === r &&
-          base_class.name != r.klass.base_class.name
-        end
-
-        def prepare_relation_for_association_merge!(r, association_name)
-          r.where_values.map! {|w| Squeel::Visitors::PredicateVisitor.can_visit?(w) ? {association_name => w} : w}
-          r.having_values.map! {|h| Squeel::Visitors::PredicateVisitor.can_visit?(h) ? {association_name => h} : h}
-          r.group_values.map! {|g| Squeel::Visitors::AttributeVisitor.can_visit?(g) ? {association_name => g} : g}
-          r.order_values.map! {|o| Squeel::Visitors::AttributeVisitor.can_visit?(o) ? {association_name => o} : o}
-          r.select_values.map! {|s| Squeel::Visitors::AttributeVisitor.can_visit?(s) ? {association_name => s} : s}
-          r.joins_values.map! {|j| [Symbol, Hash, Nodes::Stub, Nodes::Join, Nodes::KeyPath].include?(j.class) ? {association_name => j} : j}
-          r.includes_values.map! {|i| [Symbol, Hash, Nodes::Stub, Nodes::Join, Nodes::KeyPath].include?(i.class) ? {association_name => i} : i}
         end
 
         def visit!

data/lib/squeel/adapters/active_record/3.1/context.rb

@@ -17,11 +17,11 @@ module Squeel
 
         def find(object, parent = @base)
           if JoinPart === parent
-            object = object.to_sym if String === object
             case object
-            when Symbol, Nodes::Stub
+            when String, Symbol, Nodes::Stub
+              assoc_name = object.to_s
               @object.join_associations.detect { |j|
-                j.reflection.name == object.to_sym && j.parent == parent
+                j.reflection.name.to_s == assoc_name && j.parent == parent
               }
             when Nodes::Join
               @object.join_associations.detect { |j|
@@ -50,7 +50,7 @@ module Squeel
 
         def get_table(object)
           if [Symbol, String, Nodes::Stub].include?(object.class)
-            Arel::Table.new(object.to_sym, :engine => @engine)
+            Arel::Table.new(object.to_s, :engine => @engine)
           elsif Nodes::Join === object
             object._klass ? object._klass.arel_table : Arel::Table.new(object._name, :engine => @engine)
           elsif object.respond_to?(:aliased_table_name)

data/lib/squeel/adapters/active_record/3.1/relation_extensions.rb

@@ -32,28 +32,19 @@ module Squeel
           )
         end
 
-        # We need to be able to support merging two relations that have a different
-        # base class. Stock ActiveRecord doesn't have to do anything too special, because
-        # it's already created predicates out of the where_values by now, and they're
-        # already bound to the proper table.
-        #
-        # Squeel, on the other hand, needs to do its best to ensure the predicates are still
-        # winding up against the proper table. The most "correct" way I can think of to do
-        # this is to try to emulate the default AR behavior -- that is, de-squeelifying
-        # the *_values, erm... values by visiting them and converting them to ARel nodes
-        # before merging. Merging relations is a nifty little trick, but it's another
-        # little corner of ActiveRecord where the magic quickly fades. :(
-        def merge(r)
-          if relation_with_different_base?(r)
-            r = r.clone.visit!
+        # We need to be able to support merging two relations without having
+        # to get our hooks too deeply into ActiveRecord. AR's relation
+        # merge functionality is very cool, but relatively complex, to
+        # handle the various edge cases. Our best shot at avoiding strange
+        # behavior with Squeel loaded is to visit the *_values arrays in
+        # the relations we're merging, and then use the default AR merge
+        # code on the result.
+        def merge(r, relations_visited = false)
+          if relations_visited
+            super(r)
+          else
+            clone.visit!.merge(r.clone.visit!, true)
           end
-
-          super(r)
-        end
-
-        def relation_with_different_base?(r)
-          ::ActiveRecord::Relation === r &&
-          base_class.name != r.klass.base_class.name
         end
 
         def prepare_relation_for_association_merge!(r, association_name)

data/lib/squeel/adapters/active_record/relation_extensions.rb

@@ -4,7 +4,7 @@ module Squeel
   module Adapters
     module ActiveRecord
       module RelationExtensions
-        
+
         def build_arel
           arel = table.from table
 
@@ -28,15 +28,15 @@ module Squeel
           arel.order(*order) unless order.empty?
 
           build_select(arel, attribute_viz.accept(@select_values.uniq))
-          
+
           arel.distinct(@uniq_value)
           arel.from(@from_value) if @from_value
           arel.lock(@lock_value) if @lock_value
 
           arel
         end
-        
+
       end
     end
   end
-end
+end

data/lib/squeel/dsl.rb

@@ -86,8 +86,7 @@ module Squeel
     # @param [Symbol, Nodes::Stub] name The name of the sifter defined in the model.
     # @return [Nodes::Sifter] The sifter node
     def sift(name, *args)
-      name = name.to_sym if Nodes::Stub === name
-      Nodes::Sifter.new name, args
+      Nodes::Sifter.new name.to_sym, args
     end
 
     # Node generation inside DSL blocks.

data/lib/squeel/version.rb

@@ -1,3 +1,3 @@
 module Squeel
-  VERSION = "1.0.2"
+  VERSION = "1.0.3"
 end

data/lib/squeel/visitors/attribute_visitor.rb

@@ -16,10 +16,10 @@ module Squeel
       # @return [Array] An array of values for use in an ordering, grouping, etc.
       def visit_Hash(o, parent)
         o.map do |k, v|
-          if implies_context_change?(v)
-            visit_with_context_change(k, v, parent)
+          if implies_hash_context_shift?(v)
+            visit_with_hash_context_shift(k, v, parent)
           else
-            visit_without_context_change(k, v, parent)
+            visit_without_hash_context_shift(k, v, parent)
           end
         end.flatten
       end
@@ -41,7 +41,7 @@ module Squeel
       # @param parent The stub's parent within the context
       # @return [Arel::Attribute] An attribute on the contextualized parent table
       def visit_Squeel_Nodes_Stub(o, parent)
-        contextualize(parent)[o.symbol]
+        contextualize(parent)[o.to_s]
       end
 
       # Visit a Literal by converting it to an ARel SqlLiteral
@@ -94,7 +94,7 @@ module Squeel
           when Nodes::Function, Nodes::KeyPath, Nodes::As, Nodes::Literal, Nodes::Grouping
             visit(arg, parent)
           when Symbol, Nodes::Stub
-            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_sym])
+            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_s])
           else
             quote arg
           end
@@ -116,7 +116,7 @@ module Squeel
           when Nodes::Function, Nodes::KeyPath, Nodes::As, Nodes::Literal, Nodes::Grouping
             visit(arg, parent)
           when Symbol, Nodes::Stub
-            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_sym])
+            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_s])
           else
             quote arg
           end
@@ -166,7 +166,7 @@ module Squeel
 
       # @return [Boolean] Whether the given value implies a context change
       # @param v The value to consider
-      def implies_context_change?(v)
+      def implies_hash_context_shift?(v)
         can_visit?(v)
       end
 
@@ -177,7 +177,9 @@ module Squeel
       # @param v The hash value
       # @param parent The current parent object in the context
       # @return The visited value
-      def visit_with_context_change(k, v, parent)
+      def visit_with_hash_context_shift(k, v, parent)
+        @hash_context_depth += 1
+
         parent = case k
           when Nodes::KeyPath
             traverse(k, parent, true)
@@ -190,6 +192,8 @@ module Squeel
         else
           can_visit?(v) ? visit(v, parent || k) : v
         end
+      ensure
+        @hash_context_depth -= 1
       end
 
       # If there is no context change, we'll just return the value unchanged,
@@ -201,7 +205,7 @@ module Squeel
       # @param parent The current parent object in the context
       # @return The same value we just received. Yeah, this method's pretty pointless,
       #   for now, and only here for consistency's sake.
-      def visit_without_context_change(k, v, parent)
+      def visit_without_hash_context_shift(k, v, parent)
         v
       end
 

data/lib/squeel/visitors/predicate_visitor.rb

@@ -17,10 +17,10 @@ module Squeel
       # @return [Array] An array of values for use in a where or having clause
       def visit_Hash(o, parent)
         predicates = o.map do |k, v|
-          if implies_context_change?(v)
-            visit_with_context_change(k, v, parent)
+          if implies_hash_context_shift?(v)
+            visit_with_hash_context_shift(k, v, parent)
           else
-            visit_without_context_change(k, v, parent)
+            visit_without_hash_context_shift(k, v, parent)
           end
         end
 
@@ -71,7 +71,7 @@ module Squeel
       # @return [Arel::Attribute] An attribute of the parent table with the
       #   Stub's column
       def visit_Squeel_Nodes_Stub(o, parent)
-        contextualize(parent)[o.symbol]
+        contextualize(parent)[o.to_s]
       end
 
       # Visit a Literal by converting it to an ARel SqlLiteral
@@ -105,7 +105,7 @@ module Squeel
 
         case value
         when Nodes::KeyPath
-          value = can_visit?(value.endpoint) ? visit(value, parent) : contextualize(traverse(value, parent))[value.endpoint.to_sym]
+          value = can_visit?(value.endpoint) ? visit(value, parent) : contextualize(traverse(value, parent))[value.endpoint.to_s]
         when ActiveRecord::Relation
           value = visit(
             value.select_values.empty? ? value.select(value.klass.arel_table[value.klass.primary_key]) : value,
@@ -145,9 +145,9 @@ module Squeel
           when ActiveRecord::Relation
             arg.arel.ast
           when Nodes::KeyPath
-            can_visit?(arg.endpoint) ? visit(arg, parent) : contextualize(traverse(arg, parent))[arg.endpoint.to_sym]
+            can_visit?(arg.endpoint) ? visit(arg, parent) : contextualize(traverse(arg, parent))[arg.endpoint.to_s]
           when Symbol, Nodes::Stub
-            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_sym])
+            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_s])
           else
             quote arg
           end
@@ -179,9 +179,9 @@ module Squeel
           when Nodes::Function, Nodes::As, Nodes::Literal, Nodes::Grouping
             visit(arg, parent)
           when Nodes::KeyPath
-            can_visit?(arg.endpoint) ? visit(arg, parent) : contextualize(traverse(arg, parent))[arg.endpoint.to_sym]
+            can_visit?(arg.endpoint) ? visit(arg, parent) : contextualize(traverse(arg, parent))[arg.endpoint.to_s]
           when Symbol, Nodes::Stub
-            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_sym])
+            Arel.sql(arel_visitor.accept contextualize(parent)[arg.to_s])
           else
             quote arg
           end
@@ -252,7 +252,7 @@ module Squeel
 
       # @return [Boolean] Whether the given value implies a context change
       # @param v The value to consider
-      def implies_context_change?(v)
+      def implies_hash_context_shift?(v)
         case v
         when Hash, Nodes::Predicate, Nodes::Unary, Nodes::Binary, Nodes::Nary, Nodes::Sifter
           true
@@ -270,7 +270,9 @@ module Squeel
       # @param v The hash value
       # @param parent The current parent object in the context
       # @return The visited value
-      def visit_with_context_change(k, v, parent)
+      def visit_with_hash_context_shift(k, v, parent)
+        @hash_context_depth += 1
+
         parent = case k
           when Nodes::KeyPath
             traverse(k, parent, true)
@@ -290,6 +292,8 @@ module Squeel
           of key = #{k} and value = #{v}"
           END
         end
+      ensure
+        @hash_context_depth -= 1
       end
 
       # Create a predicate for a given key/value pair. If the value is
@@ -300,12 +304,12 @@ module Squeel
       # @param v The hash value
       # @param parent The current parent object in the context
       # @return An ARel predicate
-      def visit_without_context_change(k, v, parent)
+      def visit_without_hash_context_shift(k, v, parent)
         case v
         when Nodes::Stub, Symbol
-          v = contextualize(parent)[v.to_sym]
+          v = contextualize(parent)[v.to_s]
         when Nodes::KeyPath # If we could visit the endpoint, we wouldn't be here
-          v = contextualize(traverse(v, parent))[v.endpoint.to_sym]
+          v = contextualize(traverse(v, parent))[v.endpoint.to_s]
         end
 
         case k
@@ -317,11 +321,11 @@ module Squeel
           visit(k % quote_for_node(k.endpoint, v), parent)
         else
           attr_name = k.to_s
-          attribute = if attr_name.include?('.')
+          attribute = if !hash_context_shifted? && attr_name.include?('.')
               table_name, attr_name = attr_name.split(/\./, 2)
-              Arel::Table.new(table_name.to_sym, :engine => engine)[attr_name.to_sym]
+              Arel::Table.new(table_name.to_s, :engine => engine)[attr_name.to_s]
             else
-              contextualize(parent)[k.to_sym]
+              contextualize(parent)[attr_name]
             end
           arel_predicate_for(attribute, v, parent)
         end

data/lib/squeel/visitors/visitor.rb

@@ -14,6 +14,7 @@ module Squeel
       # @param [Context] context The context to use for node visitation.
       def initialize(context = nil)
         @context = context
+        @hash_context_depth = 0
       end
 
       # Accept an object.
@@ -50,6 +51,16 @@ module Squeel
         hash[klass] = "visit_#{(klass.name || '').gsub('::', '_')}"
       end
 
+      # If we're visiting stuff in a hash, it's good to check whether or
+      # not we've shifted context already. If we have, we may want to use
+      # caution as it pertains to certain input, in case it's untrusted.
+      # See CVE-2012-2661 for info.
+      #
+      # @return [Boolean] Whether we're within a new context.
+      def hash_context_shifted?
+        @hash_context_depth > 0
+      end
+
       # Important to avoid accidentally allowing the default ARel visitor's
       # last_column quoting behavior (where a value is quoted as though it
       # is of the type of the last visited column). This can wreak havoc with

data/spec/squeel/adapters/active_record/relation_extensions_spec.rb

@@ -672,6 +672,15 @@ module Squeel
             sql.should match /"articles"."title" = 'Condition'/
           end
 
+          it 'uses the last condition in the case of a conflicting where' do
+            relation = Person.where{name == 'Ernie'}.merge(
+              Person.where{name == 'Bert'}
+            )
+            sql = relation.to_sql
+            sql.should_not match /Ernie/
+            sql.should match /Bert/
+          end
+
         end
 
         describe '#to_a' do

data/spec/squeel/visitors/predicate_visitor_spec.rb

@@ -26,14 +26,14 @@ module Squeel
       it 'creates Equality nodes for simple hashes' do
         predicate = @v.accept(:name => 'Joe')
         predicate.should be_a Arel::Nodes::Equality
-        predicate.left.name.should eq :name
+        predicate.left.name.to_s.should eq 'name'
         predicate.right.should eq 'Joe'
       end
 
       it 'creates In nodes for simple hashes with an array as a value' do
         predicate = @v.accept(:name => ['Joe', 'Bob'])
         predicate.should be_a Arel::Nodes::In
-        predicate.left.name.should eq :name
+        predicate.left.name.to_s.should eq 'name'
         predicate.right.should eq ['Joe', 'Bob']
       end
 
@@ -112,14 +112,14 @@ module Squeel
       it 'allows a subquery on the value side of an explicit predicate' do
         predicate = @v.accept dsl{name.in(Person.select{name}.where{name.in(['Aric Smith', 'Gladyce Kulas'])})}
         predicate.should be_a Arel::Nodes::In
-        predicate.left.name.should eq :name
+        predicate.left.name.to_s.should eq 'name'
         predicate.right.should be_a Arel::Nodes::SelectStatement
       end
 
       it 'allows a subquery on the value side of an implicit predicate' do
         predicate = @v.accept(:name => Person.select{name}.where{name.in(['Aric Smith', 'Gladyce Kulas'])})
         predicate.should be_a Arel::Nodes::In
-        predicate.left.name.should eq :name
+        predicate.left.name.to_s.should eq 'name'
         predicate.right.should be_a Arel::Nodes::SelectStatement
       end
 
@@ -150,14 +150,14 @@ module Squeel
       it 'converts ActiveRecord::Base objects to their id' do
         predicate = @v.accept(:id => Person.first)
         predicate.should be_a Arel::Nodes::Equality
-        predicate.left.name.should eq :id
+        predicate.left.name.to_s.should eq 'id'
         predicate.right.should eq 1
       end
 
       it 'converts arrays of ActiveRecord::Base objects to their ids' do
         predicate = @v.accept(:id => [Person.first, Person.last])
         predicate.should be_a Arel::Nodes::In
-        predicate.left.name.should eq :id
+        predicate.left.name.to_s.should eq 'id'
         predicate.right.should eq [1, 332]
       end
 
@@ -305,6 +305,14 @@ module Squeel
         predicate.to_sql.should match /"things"."attribute" = 'retro'/
       end
 
+      it 'does not allow "table.column" keys after context change' do
+        result = @v.accept(:id => {'articles.person_id' => 1})
+        result.should be_a Arel::Nodes::Equality
+        result.left.should be_a Arel::Attributes::Attribute
+        result.left.relation.name.should eq 'id'
+        result.left.name.to_s.should eq 'articles.person_id'
+      end
+
       it 'visits ActiveRecord::Relation values in predicates' do
         predicate = @v.accept(dsl{id >> Person.select{id}.limit(3).order{id.desc}})
         predicate.should be_a Arel::Nodes::In
@@ -367,7 +375,7 @@ module Squeel
         predicate = @v.accept(:children => Nodes::Stub.new(:children).name.eq('Joe'))
         predicate.should be_a Arel::Nodes::Equality
         predicate.left.relation.table_alias.should eq 'children_people_2'
-        predicate.left.name.should eq :name
+        predicate.left.name.to_s.should eq 'name'
         predicate.right.should eq 'Joe'
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: squeel
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-05-30 00:00:00.000000000 Z
+date: 2012-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -240,7 +240,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -3844391929361765236
+      hash: -3464922984987800394
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -249,7 +249,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -3844391929361765236
+      hash: -3464922984987800394
 requirements: []
 rubyforge_project: squeel
 rubygems_version: 1.8.24