From 357cd23d3aedabb99fd70b812ffcea2d1cc9893d Mon Sep 17 00:00:00 2001 From: Ryuta Kamizono Date: Wed, 20 Feb 2019 20:55:09 +0900 Subject: Don't allow `where` with non numeric string matches to 0 values This is a follow-up of #35310. Currently `Topic.find_by(id: "not-a-number")` matches to a `id = 0` record. That is considered as silently leaking information. If non numeric string is given to find by an integer column, it should not be matched to any record. Related #12793. --- activemodel/test/cases/type/integer_test.rb | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'activemodel/test/cases/type') diff --git a/activemodel/test/cases/type/integer_test.rb b/activemodel/test/cases/type/integer_test.rb index 9bd0110099..304ae33de0 100644 --- a/activemodel/test/cases/type/integer_test.rb +++ b/activemodel/test/cases/type/integer_test.rb @@ -50,6 +50,14 @@ module ActiveModel assert_equal 7200, type.cast(2.hours) end + test "casting string for database" do + type = Type::Integer.new + assert_nil type.serialize("wibble") + assert_equal 5, type.serialize("5wibble") + assert_equal 5, type.serialize(" +5") + assert_equal(-5, type.serialize(" -5")) + end + test "casting empty string" do type = Type::Integer.new assert_nil type.cast("") -- cgit v1.2.3