diff options
| author | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-06-05 14:08:40 -0300 |
|---|---|---|
| committer | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-07-02 14:45:50 -0300 |
| commit | 7df68a300c9395e3edf8c603b6fea3db9eaff003 (patch) | |
| tree | d7cbf866e9bfa06fbf0c8486f31ce3e6d92578bb /activerecord/lib/active_record | |
| parent | f838caf350c3405ebdf10a6c6171adfa0a840905 (diff) | |
| download | rails-7df68a300c9395e3edf8c603b6fea3db9eaff003.tar.gz rails-7df68a300c9395e3edf8c603b6fea3db9eaff003.tar.bz2 rails-7df68a300c9395e3edf8c603b6fea3db9eaff003.zip | |
Fix SQL injection when querying against ranges and bitstrings
Fix CVE-2014-3483 and protect against CVE-2014-3482.
Diffstat (limited to 'activerecord/lib/active_record')
| -rw-r--r-- | activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb | 7 | ||||
| -rw-r--r-- | activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb | 2 |
2 files changed, 5 insertions, 4 deletions
diff --git a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb index f9541b437a..cb1c67495b 100644 --- a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb @@ -23,7 +23,8 @@ module ActiveRecord case value when Range if /range$/ =~ sql_type - "'#{PostgreSQLColumn.range_to_string(value)}'::#{sql_type}" + escaped = quote_string(PostgreSQLColumn.range_to_string(value)) + "#{escaped}::#{sql_type}" else super end @@ -52,8 +53,8 @@ module ActiveRecord when 'xml' then "xml '#{quote_string(value)}'" when /^bit/ case value - when /^[01]*$/ then "B'#{value}'" # Bit-string notation - when /^[0-9A-F]*$/i then "X'#{value}'" # Hexadecimal notation + when /\A[01]*\Z/ then "B'#{value}'" # Bit-string notation + when /\A[0-9A-F]*\Z/i then "X'#{value}'" # Hexadecimal notation end else super diff --git a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb index a164758640..8e31e165b1 100644 --- a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb +++ b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb @@ -569,7 +569,7 @@ module ActiveRecord end def exec_no_cache(sql, name, binds) - log(sql, name, binds) { @connection.async_exec(sql) } + log(sql, name, binds) { @connection.async_exec(sql, []) } end def exec_cache(sql, name, binds) |