From 958be0e7cc2571b2f57ec62491dc4ded74d29424 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Mendon=C3=A7a=20Fran=C3=A7a?= Date: Wed, 2 Jul 2014 15:24:11 -0300 Subject: [PATCH] Make sure range strings are quoted after we quote the range. --- .../connection_adapters/postgresql/quoting.rb | 2 +- .../test/cases/adapters/postgresql/quoting_test.rb | 2 +- .../test/cases/adapters/postgresql/range_test.rb | 18 ++++++++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb index 36a474d..880d0ee 100644 --- a/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb +++ b/activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb @@ -24,7 +24,7 @@ module ActiveRecord when Range if /range$/ =~ sql_type escaped = quote_string(PostgreSQLColumn.range_to_string(value)) - "#{escaped}::#{sql_type}" + "'#{escaped}'::#{sql_type}" else super end diff --git a/activerecord/test/cases/adapters/postgresql/quoting_test.rb b/activerecord/test/cases/adapters/postgresql/quoting_test.rb index 74e593f..0eb6a26 100644 --- a/activerecord/test/cases/adapters/postgresql/quoting_test.rb +++ b/activerecord/test/cases/adapters/postgresql/quoting_test.rb @@ -61,7 +61,7 @@ module ActiveRecord def test_quote_range range = "1,2]'; SELECT * FROM users; --".."a" c = PostgreSQLColumn.new(nil, nil, OID::Range.new(:integer), 'int8range') - assert_equal "[1,2]''; SELECT * FROM users; --,a]::int8range", @conn.quote(range, c) + assert_equal "'[1,2]''; SELECT * FROM users; --,a]'::int8range", @conn.quote(range, c) end end end diff --git a/activerecord/test/cases/adapters/postgresql/range_test.rb b/activerecord/test/cases/adapters/postgresql/range_test.rb index bd8317f..36ad78d 100644 --- a/activerecord/test/cases/adapters/postgresql/range_test.rb +++ b/activerecord/test/cases/adapters/postgresql/range_test.rb @@ -216,6 +216,24 @@ if ActiveRecord::Base.connection.supports_ranges? assert_equal Date.new(2012, 1, 3)..Date.new(2012, 1, 4), range.date_range end + def test_update_all_with_ranges + PostgresqlRange.create! + + PostgresqlRange.update_all(int8_range: 1..100) + + assert_equal 1...101, PostgresqlRange.first.int8_range + end + + def test_ranges_correctly_escape_input + e = assert_raises(ActiveRecord::StatementInvalid) do + range = "1,2]'; SELECT * FROM users; --".."a" + PostgresqlRange.update_all(int8_range: range) + end + + assert e.message.starts_with?("PG::InvalidTextRepresentation") + ActiveRecord::Base.connection.rollback_transaction + end + private def assert_equal_round_trip(range, attribute, value) round_trip(range, attribute, value) -- 2.0.0