提交 4358b0d1 编写于 作者: S Sean Griffin

Deprecate limit strings with commas

Some backends allow `LIMIT 1,2` as a shorthand for `LIMIT 1 OFFSET 2`.
Supporting this in Active Record massively complicates using bind
parameters for limit and offset, and it's trivially easy to build an
invalid SQL query by also calling `offset` on the same `Relation`.

This is a niche syntax that is only supported by a few adapters, and can
be trivially worked around by calling offset explicitly.
上级 9a17ce88
......@@ -677,6 +677,12 @@ def limit(value)
end
def limit!(value) # :nodoc:
if ::String === value && value.include?(",")
ActiveSupport::Deprecation.warn(<<-WARNING)
Passing a string to limit in the form "1,2" is deprecated and will be
removed in Rails 5.1. Please call `offset` explicitly instead.
WARNING
end
self.limit_value = value
self
end
......
......@@ -112,7 +112,9 @@ def test_primary_key_with_no_id
unless current_adapter?(:PostgreSQLAdapter, :OracleAdapter, :SQLServerAdapter, :FbAdapter)
def test_limit_with_comma
assert Topic.limit("1,2").to_a
assert_deprecated do
assert Topic.limit("1,2").to_a
end
end
end
......@@ -138,8 +140,10 @@ def test_limit_should_sanitize_sql_injection_for_limit_without_commas
end
def test_limit_should_sanitize_sql_injection_for_limit_with_commas
assert_raises(ArgumentError) do
Topic.limit("1, 7 procedure help()").to_a
assert_deprecated do
assert_raises(ArgumentError) do
Topic.limit("1, 7 procedure help()").to_a
end
end
end
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册