Syntax for Rails 6 SQL method

Question

The following warning is appearing on certain controller actions.

DEPRECATION WARNING: Dangerous query method (method whose arguments are used as raw SQL) called with non-attribute argument(s): 
"CASE id WHEN 343[...]". Non-attribute arguments will be disallowed in Rails 6.0. 
This method should not be called with user-provided values, 
such as request parameters or model attributes.

But this method is not being called by "user-provided" values:

def find_ordered(ids)
  order_clause = "CASE id "
  ids.each_with_index do |id, index|
    order_clause << "WHEN #{id} THEN #{index} "
  end
  order_clause << "ELSE #{ids.length} END"
  where(id: ids).order(order_clause)
end

it does invoke model attributes. So how can this initializer method be syntaxed to be acceptable to Rails 6?

Eyeslandic · Accepted Answer · 2020-07-23 16:45:42Z

2

It is not strictly 'user-provided value' but Rails cannot have any way to know whether a string comes from a user or is hard coded in the program.

The way to get around this is to use Arel.sql

Wrap a known-safe SQL string for passing to query methods, e.g.

where(id: ids).order(Arel.sql(order_clause))

answered Jul 23, 2020 at 16:45

Eyeslandic

14.9k13 gold badges44 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Syntax for Rails 6 SQL method

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related