team_fastlane-sequel_base_service 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6767b25b6ef83e0161e2cad7af91e84fc447bbf3314b0f085c5be03d872063ce
-  data.tar.gz: eaecbcd7fdb58e511358d0717973930d6f43a9de53adac084d701c245b84f25b
+  metadata.gz: d465c92837ec1227b535e84914f53b17f593eb91d8d761273d4a8c63b9909a94
+  data.tar.gz: 26b95fddc17d2cf2278d1961d562e85032e66d95fae57458d57b9878c2ed9fc2
 SHA512:
-  metadata.gz: b4a54e6529d050852c5e3020eeb0e57c1a7cdc95f43b43d07603d571f0b8facd1fa6d4ede7eb405d1f4b7d19ac8d4a8fe71f1fdbae598b2400699ef5c1e2ce74
-  data.tar.gz: 1b826be91b18de3d89bbda6ae47dca68a1e560bab640e5604ca9dcd4c0981d45700216eb8a19ba1bac3009134f556020b45fe5ed325a47eaf8fda04e8346e78d
+  metadata.gz: 244416afff39ef6c1f5ffeec1e59646e3e166f6975d8968a6d7ecb930e43b25391eceeddc4efcac75f72898e8314b1fcf049072a70c70de36aa80946326612f9
+  data.tar.gz: adaa4e362253500ab4a53ac9606bee30a3ed6622cae466aeabeda6a5e3508d656e3874b55abeed805abd5714ba7c6e9a70aaade94d3059c0766cea93eb5cf9f9

data/CHANGELOG.adoc

@@ -7,6 +7,10 @@ and this project adheres to https://semver.org[Semantic Versioning].
 
 == Unreleased
 
+== [1.0.1] - 2023-08-08
+=== Fixed
+- SECURITY: Fix a possible sql injection while setting the schema
+
 == [1.0.0] - 2023-08-01
 === Changed
 Renamed and restructured for release on rubygems

data/lib/team_fastlane/sequel_base_service/version.rb

@@ -2,6 +2,6 @@
 
 module TeamFastlane
   module SequelBaseService
-    VERSION = '1.0.0'
+    VERSION = '1.0.1'
   end
 end

data/lib/team_fastlane/sequel_base_service.rb

@@ -15,7 +15,8 @@ module TeamFastlane
       # This is a hook for having a different schema than the database user in an oracle database
       config.sequel.after_connect = -> do
         if Sequel::Model.db.opts[:schema]
-          Sequel::Model.db.run("alter session set current_schema = \"#{Sequel::Model.db.opts[:schema]}\"")
+          schema = Sequel::Model.db.literal(Sequel::Model.db.opts[:schema])
+          Sequel::Model.db.run("alter session set current_schema = \"#{schema}\"")
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: team_fastlane-sequel_base_service
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Team Fastlane
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-08-02 00:00:00.000000000 Z
+date: 2023-08-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: olive_branch