From f943e386039e0f28e777e2cf7ec39a7dbe24c040 Mon Sep 17 00:00:00 2001 From: Aaron Patterson <aaron.patterson@gmail.com> Date: Fri, 4 Jan 2013 12:02:22 -0800 Subject: [PATCH 1/2] * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu Conflicts: activerecord/lib/active_record/relation/predicate_builder.rb --- .../lib/active_record/relation/predicate_builder.rb | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/activerecord/lib/active_record/relation/predicate_builder.rb b/activerecord/lib/active_record/relation/predicate_builder.rb index e74ba73..71eabcb 100644 --- a/activerecord/lib/active_record/relation/predicate_builder.rb +++ b/activerecord/lib/active_record/relation/predicate_builder.rb @@ -11,7 +11,12 @@ module ActiveRecord if allow_table_name && value.is_a?(Hash) table = Arel::Table.new(column, :engine => @engine) - build_from_hash(value, table, false) + + if value.empty? + '1 = 2' + else + build_from_hash(value, table, false) + end else column = column.to_s -- 1.7.10.2 (Apple Git-33)