Fix for CVE-2013-0155

activerecord/lib/active_record/base.rb

@@ -2340,6 +2340,8 @@ def expand_hash_conditions_for_aggregates(attrs)
         def sanitize_sql_hash_for_conditions(attrs, default_table_name = quoted_table_name, top_level = true)
           attrs = expand_hash_conditions_for_aggregates(attrs)
 
+          return '1 = 2' if !top_level && attrs.is_a?(Hash) && attrs.empty?
+
           conditions = attrs.map do |attr, value|
             table_name = default_table_name