Defect #28930: [Rails 5.2] sanitize dangerous query statements - Redmine

Actions

Copy link

Defect #28930

closed

[Rails 5.2] sanitize dangerous query statements

Added by Pavel Rosický almost 6 years ago. Updated almost 6 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Category:

Code cleanup/refactoring

Target version:

Start date:

Due date:

% Done:

Estimated time:

Resolution:

Affected version:

Description

DEPRECATION WARNING: Dangerous query method (method whose arguments are used as raw SQL) called with non-attribute argument(s): "(CASE WHEN versions.effective_date IS NULL THEN 1 ELSE 0 END) DESC". Non-attribute arguments will be disallowed in Rails 6.0. This method should not be called with user-provided values, such as request parameters or model attributes. Known-safe values can be passed by wrapping them in Arel.sql().

Files

arelsql.patch (9.96 KB) arelsql.patch

Pavel Rosický, 2018-06-01 22:01

Related issues