From 6c82b6c99d86f37e61f935fb342cccd725d6c7d4 Mon Sep 17 00:00:00 2001 From: Xavier Noria Date: Tue, 6 Mar 2018 02:27:16 +0100 Subject: whitelist NULLS { FIRST | LAST } in order clauses --- activerecord/lib/active_record/attribute_methods.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'activerecord/lib/active_record/attribute_methods.rb') diff --git a/activerecord/lib/active_record/attribute_methods.rb b/activerecord/lib/active_record/attribute_methods.rb index 0ca0e5dcdb..122140eb55 100644 --- a/activerecord/lib/active_record/attribute_methods.rb +++ b/activerecord/lib/active_record/attribute_methods.rb @@ -177,7 +177,14 @@ module ActiveRecord # "#{table_name}.#{column_name} #{direction}" # "#{column_name}" # "#{column_name} #{direction}" - COLUMN_NAME_ORDER_WHITELIST = /\A(?:\w+\.)?\w+(?:\s+asc|\s+desc)?\z/i + COLUMN_NAME_ORDER_WHITELIST = / + \A + (?:\w+\.)? + \w+ + (?:\s+asc|\s+desc)? + (?:\s+nulls\s+(?:first|last))? + \z + /ix def enforce_raw_sql_whitelist(args, whitelist: COLUMN_NAME_WHITELIST) # :nodoc: unexpected = args.reject do |arg| -- cgit v1.2.3