mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
Allow limit values to accept an ARel SQL literal.
This commit is contained in:
parent
c6b4ef082f
commit
56fb3b1594
2 changed files with 15 additions and 5 deletions
|
@ -278,13 +278,17 @@ module ActiveRecord
|
|||
|
||||
# Sanitizes the given LIMIT parameter in order to prevent SQL injection.
|
||||
#
|
||||
# +limit+ may be anything that can evaluate to a string via #to_s. It
|
||||
# should look like an integer, or a comma-delimited list of integers.
|
||||
# The +limit+ may be anything that can evaluate to a string via #to_s. It
|
||||
# should look like an integer, or a comma-delimited list of integers, or
|
||||
# an Arel SQL literal.
|
||||
#
|
||||
# Returns Integer and Arel::Nodes::SqlLiteral limits as is.
|
||||
# Returns the sanitized limit parameter, either as an integer, or as a
|
||||
# string which contains a comma-delimited list of integers.
|
||||
def sanitize_limit(limit)
|
||||
if limit.to_s =~ /,/
|
||||
if limit.is_a?(Integer) || limit.is_a?(Arel::Nodes::SqlLiteral)
|
||||
limit
|
||||
elsif limit.to_s =~ /,/
|
||||
Arel.sql limit.to_s.split(',').map{ |i| Integer(i) }.join(',')
|
||||
else
|
||||
Integer(limit)
|
||||
|
|
|
@ -59,7 +59,7 @@ class BasicsTest < ActiveRecord::TestCase
|
|||
assert_nil Edge.primary_key
|
||||
end
|
||||
|
||||
unless current_adapter?(:PostgreSQLAdapter) || current_adapter?(:OracleAdapter)
|
||||
unless current_adapter?(:PostgreSQLAdapter,:OracleAdapter,:SQLServerAdapter)
|
||||
def test_limit_with_comma
|
||||
assert_nothing_raised do
|
||||
Topic.limit("1,2").all
|
||||
|
@ -94,7 +94,13 @@ class BasicsTest < ActiveRecord::TestCase
|
|||
Topic.limit("1, 7 procedure help()").all
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
unless current_adapter?(:MysqlAdapter)
|
||||
def test_limit_should_allow_sql_literal
|
||||
assert_equal 1, Topic.limit(Arel.sql('2-1')).all.length
|
||||
end
|
||||
end
|
||||
|
||||
def test_select_symbol
|
||||
topic_ids = Topic.select(:id).map(&:id).sort
|
||||
assert_equal Topic.find(:all).map(&:id).sort, topic_ids
|
||||
|
|
Loading…
Reference in a new issue