I am one of the reporters of this issue (Fraser Newton of Clio www.clio.com). We applied the following patch (and configured the blacklist as described in the

I am one of the reporters of this issue (Fraser Newton of Clio www.clio.com). We applied the following patch (and configured the blacklist as described in the comment) to resolve this issue. This works by rejecting any query parameters that look like user-supplied hashes while allowing developer-supplied hashes. e.g., Model.where(something: params[:something]) raises an exception if params[:something] was constructed to be a hash while Model.where(something: {id: 1}) works as expected. This also doesn't require any casting to work around the vulnerability. diff --git a/activerecord/lib/active_record/relation/predicate_builder.rb b/activerecord/lib/active_record/relation/predicate_builder.rb index 413b81c..a114f08 100644 --- a/activerecord/lib/active_record/relation/predicate_builder.rb +++ b/activerecord/lib/active_record/relation/predicate_builder.rb @@ -1,6 +1,22 @@ module ActiveRecord class PredicateBuilder # :nodoc: + + ## + # :singleton-method: + # Refuse to trust attributes of the given classes when building predicates. + # For example, the following... + # + # ActiveRecord::PredicateBuilder.blacklist = [ActionController::Parameters] + # + # ... would reject any user-supplied hashes submitted via controllers. + cattr_accessor :blacklist , :instance_writer => false + @@blacklist = [] + + def self.build_from_hash(engine, attributes, default_table, allow_table_name = true) + ActiveRecord::PredicateBuilder.blacklist.each do |blacklisted| + raise ArgumentError, "Blacklist violation: instance of #{blacklisted.name} found" if attributes.is_a?(blacklisted) + end predicates = attributes.map do |column, value| table = default_table