Merge pull request #27947 from mastahyeti/unsafe_raw_sql

Disallow raw SQL in dangerous AR methods

1 files changed, 30 insertions, 0 deletions

diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md
index 81ff2923ce..57ec37c75b 100644
--- a/activerecord/CHANGELOG.md
+++ b/activerecord/CHANGELOG.md
@@ -1,3 +1,33 @@
+*   Require raw SQL fragments to be explicitly marked when used in
+    relation query methods.
+
+    Before:
+    ```
+    Article.order("LENGTH(title)")
+    ```
+
+    After:
+    ```
+    Article.order(Arel.sql("LENGTH(title)"))
+    ```
+
+    This prevents SQL injection if applications use the [strongly
+    discouraged] form `Article.order(params[:my_order])`, under the
+    mistaken belief that only column names will be accepted.
+
+    Raw SQL strings will now cause a deprecation warning, which will
+    become an UnknownAttributeReference error in Rails 6.0. Applications
+    can opt in to the future behavior by setting `allow_unsafe_raw_sql`
+    to `:disabled`.
+
+    Common and judged-safe string values (such as simple column
+    references) are unaffected:
+    ```
+    Article.order("title DESC")
+    ```
+
+    *Ben Toews*
+
 *   `update_all` will now pass its values to `Type#cast` before passing them to
     `Type#serialize`. This means that `update_all(foo: 'true')` will properly
     persist a boolean.