diff options
| author | Ryuta Kamizono <kamipo@gmail.com> | 2019-02-20 20:55:09 +0900 |
|---|---|---|
| committer | Ryuta Kamizono <kamipo@gmail.com> | 2019-02-20 22:00:56 +0900 |
| commit | 357cd23d3aedabb99fd70b812ffcea2d1cc9893d (patch) | |
| tree | d4a21b7e618b2d4b71d0534ce180eac9040a4bd5 /activerecord/lib/arel/nodes/node.rb | |
| parent | df2ebf9b59b8ef063923136ba7097328db6c949f (diff) | |
| download | rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.tar.gz rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.tar.bz2 rails-357cd23d3aedabb99fd70b812ffcea2d1cc9893d.zip | |
Don't allow `where` with non numeric string matches to 0 values
This is a follow-up of #35310.
Currently `Topic.find_by(id: "not-a-number")` matches to a `id = 0`
record. That is considered as silently leaking information.
If non numeric string is given to find by an integer column, it should
not be matched to any record.
Related #12793.
Diffstat (limited to 'activerecord/lib/arel/nodes/node.rb')
0 files changed, 0 insertions, 0 deletions