diff --git a/CHANGELOG.md b/CHANGELOG.md index a3504a6..abbe557 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,9 +3,10 @@ ## Not released ## 0.11.4 - +* Properly escape single quote (https://github.com/Beyond-Finance/active_force/pull/29) * Fix `Time` value formatting in `.where` (https://github.com/Beyond-Finance/active_force/pull/28) + ## 0.11.3 * Fix has_one assignment when receiver does not have id (https://github.com/Beyond-Finance/active_force/pull/23) diff --git a/lib/active_force/active_query.rb b/lib/active_force/active_query.rb index d5b9208..13af20f 100644 --- a/lib/active_force/active_query.rb +++ b/lib/active_force/active_query.rb @@ -162,7 +162,7 @@ def eq_predicate(attribute, value) def enclose_value value case value when String - "'#{quote_string(value)}'" + quote_string(value) when NilClass 'NULL' when Time @@ -173,8 +173,7 @@ def enclose_value value end def quote_string(s) - # From activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, version 4.1.5, line 82 - s.gsub(/\\/, '\&\&').gsub(/'/, "''") + "'#{s.gsub(/(['\\])/, '\\\\\\1')}'" end def result diff --git a/spec/active_force/active_query_spec.rb b/spec/active_force/active_query_spec.rb index afbdd31..90acccb 100644 --- a/spec/active_force/active_query_spec.rb +++ b/spec/active_force/active_query_spec.rb @@ -250,7 +250,7 @@ let(:quote_input){ "' OR Id!=NULL OR Id='" } let(:backslash_input){ "\\" } let(:number_input){ 123 } - let(:expected_query){ "SELECT Id FROM table_name WHERE (Backslash_Field__c = '\\\\' AND NumberField = 123 AND QuoteField = ''' OR Id!=NULL OR Id=''')" } + let(:expected_query){ "SELECT Id FROM table_name WHERE (Backslash_Field__c = '\\\\' AND NumberField = 123 AND QuoteField = '\\' OR Id!=NULL OR Id=\\'')" } it 'escapes quotes and backslashes in bind parameters' do active_query.where('Backslash_Field__c = :backslash_field AND NumberField = :number_field AND QuoteField = :quote_field', number_field: number_input, backslash_field: backslash_input, quote_field: quote_input) @@ -264,7 +264,7 @@ it 'escapes quotes and backslashes in hash conditions' do active_query.where(backslash_field: backslash_input, number_field: number_input, quote_field: quote_input) - expect(active_query.to_s).to eq("SELECT Id FROM table_name WHERE (Backslash_Field__c = '\\\\') AND (NumberField = 123) AND (QuoteField = ''' OR Id!=NULL OR Id=''')") + expect(active_query.to_s).to eq("SELECT Id FROM table_name WHERE (Backslash_Field__c = '\\\\') AND (NumberField = 123) AND (QuoteField = '\\' OR Id!=NULL OR Id=\\'')") end end