From 664feb2d002501bd4a6db42f75b2221d4b9410cc Mon Sep 17 00:00:00 2001 From: Sean Griffin Date: Wed, 2 Jul 2014 11:55:52 -0600 Subject: Quote range strings when quoting PG ranges The test case for CVE-2014-3483 doesn't actually send the generated SQL to the database. The generated SQL is actually invalid for real inputs. --- .../lib/active_record/connection_adapters/postgresql/quoting.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'activerecord/lib') diff --git a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb index cb1c67495b..60b0ee526e 100644 --- a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb @@ -24,7 +24,7 @@ module ActiveRecord when Range if /range$/ =~ sql_type escaped = quote_string(PostgreSQLColumn.range_to_string(value)) - "#{escaped}::#{sql_type}" + "'#{escaped}'::#{sql_type}" else super end -- cgit v1.2.3