Rails Ruby on Rails

Comments and changes to this ticket

• 

  CancelProfileIsBroken September 25th, 2009 @ 12:08 PM

  • Tag changed from “2.3.4, postgres” to “2.3.4, bugmash, postgres”
  • Assigned user cleared.

• You flagged this item as spam.
  

  Biju Devassy October 5th, 2009 @ 10:38 AM

  • Assigned user set to “José Valim”
• 

  José Valim October 5th, 2009 @ 03:57 PM

  • Assigned user cleared.

• You flagged this item as spam.
  

  Biju Devassy January 29th, 2010 @ 09:45 AM

  • no changes were found...

• You flagged this item as spam.
  

  Lucas de Castro January 29th, 2010 @ 11:58 AM

  This problem was fixed: http://github.com/mneumann/postgres-pr/issues/closed/#issue/1

  Update your postgres-pr gem to version 0.6.3 and all will work fine.

• 

  Jeremy Kemper January 29th, 2010 @ 11:50 PM

  • State changed from “new” to “invalid”

• You flagged this item as spam.
  

  Mo Morsi August 17th, 2010 @ 08:26 PM

  • Importance changed from “” to “”

  Is this issue really invalid? We are still running into this problem w/ Rails 2.3.8.

  Here's the thing, the activerecord postgres adapter claims to work w/ both the native C postgres adapter as well as the pure ruby one (postgres-pr)

  http://github.com/rails/rails/blob/master/activerecord/lib/active_r...
  http://api.rubyonrails.org/classes/ActiveRecord/ConnectionAdapters/...

  So even if one isn't using postgres-pr (which we are not) this should work.

  Postgres-pr defines the necessary PGconn methods which the activerecord postgres adapter uses. The thing is, activerecord still checks to see if these methods are present on the PGconn class (via PGconn.respond_to?(:method_name)) before invoking them. That way if those methods don't exist (which I'm guessing they don't in the native postgres interface), no error is raised.

  The problem is, this check never gets performed before the PGconn.quote_ident call.

  The following patch adds this check around quote_ident, bringing it inline with the other PGconn method invocations, and resolving this issue:

  --- activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb.orig  2010-08-16 21:14:25.710395992 -0400
  +++ activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb 2010-08-16 21:15:33.091702801 -0400
  @@ -407,7 +407,11 @@ module ActiveRecord
   
         # Quotes column names for use in SQL queries.
         def quote_column_name(name) #:nodoc:
  -        PGconn.quote_ident(name.to_s)
  +        if PGconn.respond_to?(:quote_ident)
  +          PGconn.quote_ident(name.to_s)
  +        else
  +          %("#{name}")
  +        end
         end 
   
         # Quote date/time values for use in SQL input. Includes microseconds
  

• You flagged this item as spam.
  

  Mo Morsi September 8th, 2010 @ 07:12 PM

  So apparently fixing this with the patch I described opens a security vulnerability as quote_ident escapes strings passed in to prevent sql injection attacks and such.

  Here is an updated patch which simply just fails with a better error if quote_ident is not defined (the same thing you are doing with unescape_bytea).

  We are shipping this patch with rubygem-activerecord-2.3.8 in the upcoming Fedora 14.

  http://pkgs.fedoraproject.org/gitweb/?p=rubygem-activerecord.git;a=...

  --- activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb.orig  2010-09-08 13:41:46.000000000 -0400
  +++ activerecord-2.3.8/lib/active_record/connection_adapters/postgresql_adapter.rb  2010-09-08 13:42:39.000000000 -0400
  @@ -407,6 +407,9 @@ module ActiveRecord
   
         # Quotes column names for use in SQL queries.
         def quote_column_name(name) #:nodoc:
  +        unless PGconn.respond_to?(:quote_ident)
  +           raise 'Your PostgreSQL connection does not support quote_ident. Try upgrading pg.'
  +        end
           PGconn.quote_ident(name.to_s)
         end
  

  Note this issue has been fixed in the upstream ruby-postgres project as well, whose updated version we will be shipping in Fedora 14 as well. This patch is for consistancy's sake, and in case any other postgres adapter doesn't implement this method.