Fix SQL injection via nested hashes in conditions. CVE-2012-2695 #1037
This commit is contained in:
parent
d629209364
commit
16e266e7e5
|
@ -151,3 +151,42 @@ module ActionController
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
# Backported fix for CVE-2012-2695
|
||||||
|
# https://groups.google.com/group/rubyonrails-security/browse_thread/thread/9782f44c4540cf59
|
||||||
|
# TODO: Remove this once we are on Rails >= 3.2.6
|
||||||
|
require 'active_record/base'
|
||||||
|
module ActiveRecord
|
||||||
|
class Base
|
||||||
|
class << self
|
||||||
|
def sanitize_sql_hash_for_conditions(attrs, default_table_name = quoted_table_name, top_level = true)
|
||||||
|
attrs = expand_hash_conditions_for_aggregates(attrs)
|
||||||
|
|
||||||
|
conditions = attrs.map do |attr, value|
|
||||||
|
table_name = default_table_name
|
||||||
|
|
||||||
|
if not value.is_a?(Hash)
|
||||||
|
attr = attr.to_s
|
||||||
|
|
||||||
|
# Extract table name from qualified attribute names.
|
||||||
|
if attr.include?('.') and top_level
|
||||||
|
attr_table_name, attr = attr.split('.', 2)
|
||||||
|
attr_table_name = connection.quote_table_name(attr_table_name)
|
||||||
|
else
|
||||||
|
attr_table_name = table_name
|
||||||
|
end
|
||||||
|
|
||||||
|
attribute_condition("#{attr_table_name}.#{connection.quote_column_name(attr)}", value)
|
||||||
|
elsif top_level
|
||||||
|
sanitize_sql_hash_for_conditions(value, connection.quote_table_name(attr.to_s), false)
|
||||||
|
else
|
||||||
|
raise ActiveRecord::StatementInvalid
|
||||||
|
end
|
||||||
|
end.join(' AND ')
|
||||||
|
|
||||||
|
replace_bind_variables(conditions, expand_range_bind_variables(attrs.values))
|
||||||
|
end
|
||||||
|
alias_method :sanitize_sql_hash, :sanitize_sql_hash_for_conditions
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
Loading…
Reference in New Issue