1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00

Allow column_name AS alias as safe SQL string

This commit is contained in:
Ryuta Kamizono 2019-06-10 06:21:23 +09:00
parent 1340498d21
commit 6607ecb2a1
5 changed files with 14 additions and 0 deletions

View file

@ -159,6 +159,7 @@ module ActiveRecord
\A
(
(?:\w+\.)?\w+
(?:(?:\s+AS)?\s+\w+)?
)
(?:\s*,\s*\g<1>)*
\z

View file

@ -44,6 +44,7 @@ module ActiveRecord
\A
(
(?:\w+\.|`\w+`\.)?(?:\w+|`\w+`)
(?:(?:\s+AS)?\s+(?:\w+|`\w+`))?
)
(?:\s*,\s*\g<1>)*
\z

View file

@ -90,6 +90,7 @@ module ActiveRecord
\A
(
(?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)?
(?:(?:\s+AS)?\s+(?:\w+|"\w+"))?
)
(?:\s*,\s*\g<1>)*
\z

View file

@ -57,6 +57,7 @@ module ActiveRecord
\A
(
(?:\w+\.|"\w+"\.)?(?:\w+|"\w+")
(?:(?:\s+AS)?\s+(?:\w+|"\w+"))?
)
(?:\s*,\s*\g<1>)*
\z

View file

@ -223,6 +223,16 @@ class UnsafeRawSqlTest < ActiveRecord::TestCase
assert_equal titles_expected, titles_disabled
end
test "pluck: allows string column name with alias" do
titles_expected = Post.pluck(Arel.sql("title"))
titles_depr = with_unsafe_raw_sql_deprecated { Post.pluck("title AS posts_title") }
titles_disabled = with_unsafe_raw_sql_disabled { Post.pluck("title AS posts_title") }
assert_equal titles_expected, titles_depr
assert_equal titles_expected, titles_disabled
end
test "pluck: allows symbol column name" do
titles_expected = Post.pluck(Arel.sql("title"))