diff options
| author | Ryuta Kamizono <kamipo@gmail.com> | 2019-06-11 14:25:46 +0900 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-06-11 14:25:46 +0900 |
| commit | 4dcb46182a4aaa57f44f3eb722c1db54fa0ff843 (patch) | |
| tree | 486e6db83600ec49578b8db900569c5ab1c7e0ca /activerecord/lib | |
| parent | 0542e0608f86d9e4089861f4e72c578bc983f89f (diff) | |
| parent | 64d8c54e16ee9ad3b591501401d6c437304e1308 (diff) | |
| download | rails-4dcb46182a4aaa57f44f3eb722c1db54fa0ff843.tar.gz rails-4dcb46182a4aaa57f44f3eb722c1db54fa0ff843.tar.bz2 rails-4dcb46182a4aaa57f44f3eb722c1db54fa0ff843.zip | |
Merge pull request #36448 from kamipo/allow_column_name_with_simple_function_call
Allow column name with function (e.g. `length(title)`) as safe SQL string
Diffstat (limited to 'activerecord/lib')
4 files changed, 32 insertions, 8 deletions
diff --git a/activerecord/lib/active_record/connection_adapters/abstract/quoting.rb b/activerecord/lib/active_record/connection_adapters/abstract/quoting.rb index e34f4f745f..1b6ba8ce97 100644 --- a/activerecord/lib/active_record/connection_adapters/abstract/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/abstract/quoting.rb @@ -158,7 +158,10 @@ module ActiveRecord COLUMN_NAME = / \A ( - (?:\w+\.)?\w+ + (?: + # table_name.column_name | function(one or no argument) + ((?:\w+\.)?\w+) | \w+\((?:|\g<2>)\) + ) (?:(?:\s+AS)?\s+\w+)? ) (?:\s*,\s*\g<1>)* @@ -179,7 +182,10 @@ module ActiveRecord COLUMN_NAME_WITH_ORDER = / \A ( - (?:\w+\.)?\w+ + (?: + # table_name.column_name | function(one or no argument) + ((?:\w+\.)?\w+) | \w+\((?:|\g<2>)\) + ) (?:\s+ASC|\s+DESC)? (?:\s+NULLS\s+(?:FIRST|LAST))? ) diff --git a/activerecord/lib/active_record/connection_adapters/mysql/quoting.rb b/activerecord/lib/active_record/connection_adapters/mysql/quoting.rb index a0829b1115..dfed5471f4 100644 --- a/activerecord/lib/active_record/connection_adapters/mysql/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/mysql/quoting.rb @@ -43,7 +43,10 @@ module ActiveRecord COLUMN_NAME = / \A ( - (?:\w+\.|`\w+`\.)?(?:\w+|`\w+`) + (?: + # `table_name`.`column_name` | function(one or no argument) + ((?:\w+\.|`\w+`\.)?(?:\w+|`\w+`)) | \w+\((?:|\g<2>)\) + ) (?:(?:\s+AS)?\s+(?:\w+|`\w+`))? ) (?:\s*,\s*\g<1>)* @@ -53,7 +56,10 @@ module ActiveRecord COLUMN_NAME_WITH_ORDER = / \A ( - (?:\w+\.|`\w+`\.)?(?:\w+|`\w+`) + (?: + # `table_name`.`column_name` | function(one or no argument) + ((?:\w+\.|`\w+`\.)?(?:\w+|`\w+`)) | \w+\((?:|\g<2>)\) + ) (?:\s+ASC|\s+DESC)? ) (?:\s*,\s*\g<1>)* diff --git a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb index d18c5c5c12..0c800dca83 100644 --- a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb @@ -89,7 +89,10 @@ module ActiveRecord COLUMN_NAME = / \A ( - (?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)? + (?: + # "table_name"."column_name"::type_name | function(one or no argument)::type_name + ((?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)?) | \w+\((?:|\g<2>)\)(?:::\w+)? + ) (?:(?:\s+AS)?\s+(?:\w+|"\w+"))? ) (?:\s*,\s*\g<1>)* @@ -99,7 +102,10 @@ module ActiveRecord COLUMN_NAME_WITH_ORDER = / \A ( - (?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)? + (?: + # "table_name"."column_name"::type_name | function(one or no argument)::type_name + ((?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)?) | \w+\((?:|\g<2>)\)(?:::\w+)? + ) (?:\s+ASC|\s+DESC)? (?:\s+NULLS\s+(?:FIRST|LAST))? ) diff --git a/activerecord/lib/active_record/connection_adapters/sqlite3/quoting.rb b/activerecord/lib/active_record/connection_adapters/sqlite3/quoting.rb index 5d6932e4ca..54808de714 100644 --- a/activerecord/lib/active_record/connection_adapters/sqlite3/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/sqlite3/quoting.rb @@ -56,7 +56,10 @@ module ActiveRecord COLUMN_NAME = / \A ( - (?:\w+\.|"\w+"\.)?(?:\w+|"\w+") + (?: + # "table_name"."column_name" | function(one or no argument) + ((?:\w+\.|"\w+"\.)?(?:\w+|"\w+")) | \w+\((?:|\g<2>)\) + ) (?:(?:\s+AS)?\s+(?:\w+|"\w+"))? ) (?:\s*,\s*\g<1>)* @@ -66,7 +69,10 @@ module ActiveRecord COLUMN_NAME_WITH_ORDER = / \A ( - (?:\w+\.|"\w+"\.)?(?:\w+|"\w+") + (?: + # "table_name"."column_name" | function(one or no argument) + ((?:\w+\.|"\w+"\.)?(?:\w+|"\w+")) | \w+\((?:|\g<2>)\) + ) (?:\s+ASC|\s+DESC)? ) (?:\s*,\s*\g<1>)* |