[DRE-commits] [SCM] ruby-activerecord-3.2.git branch, master, updated. debian/3.2.6-2-6-g90102ae

[Antonio Terceiro]

The following commit has been merged in the master branch:
commit 39219f71033844adae1800f710dcbfecfda1e9f3
Author: Antonio Terceiro <terceiro at debian.org>
Date:   Thu Jan 3 11:05:08 2013 -0300

    Add upstream patch to fix CVE-2012-5664

diff --git a/debian/patches/3-2-dynamic_finder_injection.patch b/debian/patches/3-2-dynamic_finder_injection.patch
new file mode 100644
index 0000000..fe698f0
--- /dev/null
+++ b/debian/patches/3-2-dynamic_finder_injection.patch
@@ -0,0 +1,55 @@
+From 325669f0795a9148fd31f7f496a40dc8e114ef52 Mon Sep 17 00:00:00 2001
+From: Aaron Patterson <aaron.patterson at gmail.com>
+Date: Sun, 23 Dec 2012 11:07:07 -0800
+Subject: [PATCH] CVE-2012-5664 options hashes should only be extracted if
+ there are extra parameters
+
+---
+ activerecord/lib/active_record/dynamic_matchers.rb |    7 ++++++-
+ activerecord/test/cases/finder_test.rb             |   12 ++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/activerecord/lib/active_record/dynamic_matchers.rb b/activerecord/lib/active_record/dynamic_matchers.rb
+index b6b8e24..f15d0b7 100644
+--- a/activerecord/lib/active_record/dynamic_matchers.rb
++++ b/activerecord/lib/active_record/dynamic_matchers.rb
+@@ -40,7 +40,12 @@ module ActiveRecord
+           METHOD
+           send(method_id, *arguments)
+         elsif match.finder?
+-          options = arguments.extract_options!
++          options = if arguments.length > attribute_names.size
++                      arguments.extract_options!
++                    else
++                      {}
++                    end
++
+           relation = options.any? ? scoped(options) : scoped
+           relation.send :find_by_attributes, match, attribute_names, *arguments, &block
+         elsif match.instantiator?
+diff --git a/activerecord/test/cases/finder_test.rb b/activerecord/test/cases/finder_test.rb
+index 5d72e35..77ca3b5 100644
+--- a/activerecord/test/cases/finder_test.rb
++++ b/activerecord/test/cases/finder_test.rb
+@@ -15,6 +15,18 @@ require 'models/toy'
+ class FinderTest < ActiveRecord::TestCase
+   fixtures :companies, :topics, :entrants, :developers, :developers_projects, :posts, :comments, :accounts, :authors, :customers, :categories, :categorizations
+ 
++  def test_find_by_id_with_hash
++    assert_raises(ActiveRecord::StatementInvalid) do
++      Post.find_by_id(:limit => 1)
++    end
++  end
++
++  def test_find_by_title_and_id_with_hash
++    assert_raises(ActiveRecord::StatementInvalid) do
++      Post.find_by_title_and_id('foo', :limit => 1)
++    end
++  end
++
+   def test_find
+     assert_equal(topics(:first).title, Topic.find(1).title)
+   end
+-- 
+1.7.10.2 (Apple Git-33)
+
diff --git a/debian/patches/series b/debian/patches/series
index 2d73934..1524d9e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 Remove_rubygems_dependency.patch
+3-2-dynamic_finder_injection.patch

-- 
ruby-activerecord-3.2.git