From 664feb2d002501bd4a6db42f75b2221d4b9410cc Mon Sep 17 00:00:00 2001 From: Sean Griffin Date: Wed, 2 Jul 2014 11:55:52 -0600 Subject: Quote range strings when quoting PG ranges The test case for CVE-2014-3483 doesn't actually send the generated SQL to the database. The generated SQL is actually invalid for real inputs. --- .../test/cases/adapters/postgresql/quoting_test.rb | 2 +- .../test/cases/adapters/postgresql/range_test.rb | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) (limited to 'activerecord/test/cases') diff --git a/activerecord/test/cases/adapters/postgresql/quoting_test.rb b/activerecord/test/cases/adapters/postgresql/quoting_test.rb index 134c037a83..6f00c0d333 100644 --- a/activerecord/test/cases/adapters/postgresql/quoting_test.rb +++ b/activerecord/test/cases/adapters/postgresql/quoting_test.rb @@ -61,7 +61,7 @@ module ActiveRecord def test_quote_range range = "1,2]'; SELECT * FROM users; --".."a" c = PostgreSQLColumn.new(nil, nil, OID::Range.new(Type::Integer.new, :int8range)) - assert_equal "[1,2]''; SELECT * FROM users; --,a]::int8range", @conn.quote(range, c) + assert_equal "'[1,2]''; SELECT * FROM users; --,a]'::int8range", @conn.quote(range, c) end def test_quote_bit_string diff --git a/activerecord/test/cases/adapters/postgresql/range_test.rb b/activerecord/test/cases/adapters/postgresql/range_test.rb index 0f6e39322c..02d0a9b483 100644 --- a/activerecord/test/cases/adapters/postgresql/range_test.rb +++ b/activerecord/test/cases/adapters/postgresql/range_test.rb @@ -262,6 +262,23 @@ _SQL assert_raises(ArgumentError) { PostgresqlRange.create!(float_range: "(0.5, 0.7]") } end + def test_update_all_with_ranges + PostgresqlRange.create! + + PostgresqlRange.update_all(int8_range: 1..100) + + assert_equal 1...101, PostgresqlRange.first.int8_range + end + + def test_ranges_correctly_escape_input + e = assert_raises(ActiveRecord::StatementInvalid) do + range = "1,2]'; SELECT * FROM users; --".."a" + PostgresqlRange.update_all(int8_range: range) + end + + assert e.message.starts_with?("PG::InvalidTextRepresentation") + end + private def assert_equal_round_trip(range, attribute, value) round_trip(range, attribute, value) -- cgit v1.2.3