Jörg's profile - rails

Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Jörg's latest activity

Tuesday, January 18 2011

6299 Possible SQL injection in ActiveRecord limit was updated in Ruby on Rails

Jörg commented at 9:17 AM

I am using arel 2.0.6.

We had a look at 2.0.7 and found a new test that checks the escaping of limit in mysql: https://github.com/rails/arel/blob/master/test/v...

Monday, January 17 2011

6299 Possible SQL injection in ActiveRecord limit was created in Ruby on Rails

Jörg created the ticket at 9:56 AM
When you use limit in your query it is possible to inject sql code. Unlike in Rails 2 values for limit won't be converted to integer thus allowing to inject sql...