activerecord-hackery / ransack

Object-based searching.
https://activerecord-hackery.github.io/ransack/
MIT License
5.61k stars 782 forks source link

[BUG][RoR 7.1] ActiveRecord::normalizes can break `cont` predicate #1488

Open AmShaegar13 opened 2 months ago

AmShaegar13 commented 2 months ago

When normalizing attributes using the new ActiveRecord::normalizes method, % could be tampered with.

class User < ActiveRecord::Base
  normalizes :name, with: ->(name) { name.gsub(/[^a-z0-9]/, '_') }
end

User.ransack({ name_cont: 'foo' }).result.to_sql
# => "SELECT \"users\".* FROM \"users\" WHERE \"users\".\"name\" LIKE '_foo_'"
#                                                                      ^   ^
#                                                                      %foo%

Failing test

In my opinion, this should not be possible as normalizes should only apply to the attribute itself and the search term but not the wildcards.