try using regexes

1 files changed, 16 insertions, 32 deletions

diff --git a/activerecord/lib/active_record/attribute_methods.rb b/activerecord/lib/active_record/attribute_methods.rb
index ff381b4e0b..64f81ca582 100644
--- a/activerecord/lib/active_record/attribute_methods.rb
+++ b/activerecord/lib/active_record/attribute_methods.rb
@@ -167,12 +167,24 @@ module ActiveRecord
         end
       end
 
-      def enforce_raw_sql_whitelist(args, whitelist: attribute_names_and_aliases) # :nodoc:
+      # Regexp whitelist. Matches the following:
+      #   "#{table_name}.#{column_name}"
+      #   "#{column_name}"
+      COLUMN_NAME_WHITELIST = /\A(?:\w+\.)?\w+\z/i
+
+      # Regexp whitelist. Matches the following:
+      #   "#{table_name}.#{column_name}"
+      #   "#{table_name}.#{column_name} #{direction}"
+      #   "#{column_name}"
+      #   "#{column_name} #{direction}"
+      COLUMN_NAME_ORDER_WHITELIST = /\A(?:\w+\.)?\w+(?:\s+asc|\s+desc)?\z/i
+
+      def enforce_raw_sql_whitelist(args, whitelist: COLUMN_NAME_WHITELIST) # :nodoc:
         unexpected = args.reject do |arg|
-          whitelist.include?(arg.to_s) ||
-            arg.kind_of?(Arel::Node) ||
+          arg.kind_of?(Arel::Node) ||
             arg.is_a?(Arel::Nodes::SqlLiteral) ||
-            arg.is_a?(Arel::Attributes::Attribute)
+            arg.is_a?(Arel::Attributes::Attribute) ||
+            arg.to_s.split(/\s*,\s*/).all? { |part| whitelist.match?(part) }
         end
 
         return if unexpected.none?
@@ -195,22 +207,6 @@ module ActiveRecord
         end
       end
 
-      # Can the given name be treated as a column name? Returns true if name
-      # is attribute or attribute alias.
-      #
-      #   class Person < ActiveRecord::Base
-      #   end
-      #
-      #   Person.respond_to_attribute?(:name)
-      #   # => true
-      #
-      #   Person.respond_to_attribute?("foo")
-      #   # => false
-      def respond_to_attribute?(name) # :nodoc:
-        name = name.to_s
-        attribute_names.include?(name) || attribute_aliases.include?(name)
-      end
-
       # Returns true if the given attribute exists, otherwise false.
       #
       #   class Person < ActiveRecord::Base
@@ -242,18 +238,6 @@ module ActiveRecord
           ConnectionAdapters::NullColumn.new(name)
         end
       end
-
-      # An Array of String attribute names and aliases for accessing those
-      # attributes.
-      #
-      #   class Person < ActiveRecord::Base
-      #   end
-      #
-      #   Person.attribute_names_and_aliases
-      #   # => ["id", "created_at", "updated_at", "name", "age"]
-      def attribute_names_and_aliases # :nodoc:
-        attribute_names + attribute_aliases.keys
-      end
     end
 
     # A Person object with a name attribute can ask <tt>person.respond_to?(:name)</tt>,