Add test case to prevent possible SQL injection

3 files changed, 23 insertions, 1 deletions

diff --git a/activerecord/lib/arel/visitors/to_sql.rb b/activerecord/lib/arel/visitors/to_sql.rb
index 7e3e265208..72efac72bf 100644
--- a/activerecord/lib/arel/visitors/to_sql.rb
+++ b/activerecord/lib/arel/visitors/to_sql.rb
@@ -805,7 +805,9 @@ module Arel # :nodoc: all
         end
 
         def sanitize_as_sql_comment(o)
-          o.expr.map { |v| v.gsub(%r{ /\*\+?\s* | \s*\*/ }x, "") }
+          o.expr.map { |v|
+            v.gsub(%r{ (/ (?: | \g<1>) \*) \+? \s* | \s* (\* (?: | \g<2>) /) }x, "")
+          }
         end
 
         def collect_optimizer_hints(o, collector)
diff --git a/activerecord/test/cases/adapters/mysql2/optimizer_hints_test.rb b/activerecord/test/cases/adapters/mysql2/optimizer_hints_test.rb
index 31a002e935..b9794c5710 100644
--- a/activerecord/test/cases/adapters/mysql2/optimizer_hints_test.rb
+++ b/activerecord/test/cases/adapters/mysql2/optimizer_hints_test.rb
@@ -13,13 +13,23 @@ if supports_optimizer_hints?
         posts = posts.select(:id).where(author_id: [0, 1])
         assert_includes posts.explain, "| index | index_posts_on_author_id | index_posts_on_author_id |"
       end
+    end
 
+    def test_optimizer_hints_is_sanitized
       assert_sql(%r{\ASELECT /\*\+ NO_RANGE_OPTIMIZATION\(posts index_posts_on_author_id\) \*/}) do
         posts = Post.optimizer_hints("/*+ NO_RANGE_OPTIMIZATION(posts index_posts_on_author_id) */")
         posts = posts.select(:id).where(author_id: [0, 1])
         assert_includes posts.explain, "| index | index_posts_on_author_id | index_posts_on_author_id |"
       end
 
+      assert_sql(%r{\ASELECT /\*\+  `posts`\.\*,  \*/}) do
+        posts = Post.optimizer_hints("**// `posts`.*, //**")
+        posts = posts.select(:id).where(author_id: [0, 1])
+        assert_equal({ "id" => 1 }, posts.first.as_json)
+      end
+    end
+
+    def test_optimizer_hints_with_unscope
       assert_sql(%r{\ASELECT `posts`\.`id`}) do
         posts = Post.optimizer_hints("/*+ NO_RANGE_OPTIMIZATION(posts index_posts_on_author_id) */")
         posts = posts.select(:id).where(author_id: [0, 1])
diff --git a/activerecord/test/cases/adapters/postgresql/optimizer_hints_test.rb b/activerecord/test/cases/adapters/postgresql/optimizer_hints_test.rb
index 4fac7ffdc0..5e4bf232e1 100644
--- a/activerecord/test/cases/adapters/postgresql/optimizer_hints_test.rb
+++ b/activerecord/test/cases/adapters/postgresql/optimizer_hints_test.rb
@@ -17,13 +17,23 @@ if supports_optimizer_hints?
         posts = posts.select(:id).where(author_id: [0, 1])
         assert_includes posts.explain, "Seq Scan on posts"
       end
+    end
 
+    def test_optimizer_hints_is_sanitized
       assert_sql(%r{\ASELECT /\*\+ SeqScan\(posts\) \*/}) do
         posts = Post.optimizer_hints("/*+ SeqScan(posts) */")
         posts = posts.select(:id).where(author_id: [0, 1])
         assert_includes posts.explain, "Seq Scan on posts"
       end
 
+      assert_sql(%r{\ASELECT /\*\+  "posts"\.\*,  \*/}) do
+        posts = Post.optimizer_hints("**// \"posts\".*, //**")
+        posts = posts.select(:id).where(author_id: [0, 1])
+        assert_equal({ "id" => 1 }, posts.first.as_json)
+      end
+    end
+
+    def test_optimizer_hints_with_unscope
       assert_sql(%r{\ASELECT "posts"\."id"}) do
         posts = Post.optimizer_hints("/*+ SeqScan(posts) */")
         posts = posts.select(:id).where(author_id: [0, 1])