diff options
| author | Ryuta Kamizono <kamipo@gmail.com> | 2019-02-20 20:55:09 +0900 |
|---|---|---|
| committer | Ryuta Kamizono <kamipo@gmail.com> | 2019-02-20 22:00:56 +0900 |
| commit | 357cd23d3aedabb99fd70b812ffcea2d1cc9893d (patch) | |
| tree | d4a21b7e618b2d4b71d0534ce180eac9040a4bd5 /activemodel/test/cases/type | |
| parent | df2ebf9b59b8ef063923136ba7097328db6c949f (diff) | |
| download | rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.tar.gz rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.tar.bz2 rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.zip | |
Don't allow `where` with non numeric string matches to 0 values
This is a follow-up of #35310.
Currently `Topic.find_by(id: "not-a-number")` matches to a `id = 0`
record. That is considered as silently leaking information.
If non numeric string is given to find by an integer column, it should
not be matched to any record.
Related #12793.
Diffstat (limited to 'activemodel/test/cases/type')
| -rw-r--r-- | activemodel/test/cases/type/integer_test.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/activemodel/test/cases/type/integer_test.rb b/activemodel/test/cases/type/integer_test.rb index 9bd0110099..304ae33de0 100644 --- a/activemodel/test/cases/type/integer_test.rb +++ b/activemodel/test/cases/type/integer_test.rb @@ -50,6 +50,14 @@ module ActiveModel assert_equal 7200, type.cast(2.hours) end + test "casting string for database" do + type = Type::Integer.new + assert_nil type.serialize("wibble") + assert_equal 5, type.serialize("5wibble") + assert_equal 5, type.serialize(" +5") + assert_equal(-5, type.serialize(" -5")) + end + test "casting empty string" do type = Type::Integer.new assert_nil type.cast("") |