提交 6607ecb2 编写于 作者: R Ryuta Kamizono

Allow `column_name AS alias` as safe SQL string

上级 1340498d
......@@ -159,6 +159,7 @@ def column_name_with_order_matcher # :nodoc:
\A
(
(?:\w+\.)?\w+
(?:(?:\s+AS)?\s+\w+)?
)
(?:\s*,\s*\g<1>)*
\z
......
......@@ -44,6 +44,7 @@ def column_name_with_order_matcher
\A
(
(?:\w+\.|`\w+`\.)?(?:\w+|`\w+`)
(?:(?:\s+AS)?\s+(?:\w+|`\w+`))?
)
(?:\s*,\s*\g<1>)*
\z
......
......@@ -90,6 +90,7 @@ def column_name_with_order_matcher
\A
(
(?:\w+\.|"\w+"\.)?(?:\w+|"\w+")(?:::\w+)?
(?:(?:\s+AS)?\s+(?:\w+|"\w+"))?
)
(?:\s*,\s*\g<1>)*
\z
......
......@@ -57,6 +57,7 @@ def column_name_with_order_matcher
\A
(
(?:\w+\.|"\w+"\.)?(?:\w+|"\w+")
(?:(?:\s+AS)?\s+(?:\w+|"\w+"))?
)
(?:\s*,\s*\g<1>)*
\z
......
......@@ -223,6 +223,16 @@ class UnsafeRawSqlTest < ActiveRecord::TestCase
assert_equal titles_expected, titles_disabled
end
test "pluck: allows string column name with alias" do
titles_expected = Post.pluck(Arel.sql("title"))
titles_depr = with_unsafe_raw_sql_deprecated { Post.pluck("title AS posts_title") }
titles_disabled = with_unsafe_raw_sql_disabled { Post.pluck("title AS posts_title") }
assert_equal titles_expected, titles_depr
assert_equal titles_expected, titles_disabled
end
test "pluck: allows symbol column name" do
titles_expected = Post.pluck(Arel.sql("title"))
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册