{"action":"created","comment":{"url":"https://api.github.com/repos/rails/rails/pulls/comments/100143171","pull_request_review_id":20839534,"id":100143171,"diff_hunk":"@@ -158,7 +158,23 @@ def calculate(operation, column_name)\n     # See also #ids.\n     #\n     def pluck(*column_names)\n-      if loaded? && (column_names.map(&:to_s) - @klass.attribute_names - @klass.attribute_aliases.keys).empty?\n+      if loaded? && @klass.effective_column_name?(column_names)\n+        return records.pluck(*column_names)\n+      end\n+\n+      if has_include?(column_names.first)\n+        construct_relation_for_association_calculations.pluck(*column_names)\n+      else\n+        if ActiveRecord::Base.guard_unsafe_raw_sql && !@klass.effective_column_name?(column_names)\n+          raise ArgumentError, \"Invalid column name: #{column_names}\"\n+        end\n+\n+        unsafe_raw_pluck(*column_names)\n+      end\n+    end\n+\n+    def unsafe_raw_pluck(*column_names)","path":"activerecord/lib/active_record/relation/calculations.rb","position":20,"original_position":20,"commit_id":"30ecd74c870344df3c1a0f02853836fb7bd2e86d","original_commit_id":"30ecd74c870344df3c1a0f02853836fb7bd2e86d","user":{"login":"eileencodes","id":1080678,"avatar_url":"https://avatars.githubusercontent.com/u/1080678?v=3","gravatar_id":"","url":"https://api.github.com/users/eileencodes","html_url":"https://github.com/eileencodes","followers_url":"https://api.github.com/users/eileencodes/followers","following_url":"https://api.github.com/users/eileencodes/following{/other_user}","gists_url":"https://api.github.com/users/eileencodes/gists{/gist_id}","starred_url":"https://api.github.com/users/eileencodes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eileencodes/subscriptions","organizations_url":"https://api.github.com/users/eileencodes/orgs","repos_url":"https://api.github.com/users/eileencodes/repos","events_url":"https://api.github.com/users/eileencodes/events{/privacy}","received_events_url":"https://api.github.com/users/eileencodes/received_events","type":"User","site_admin":true},"body":"Should this have documentation?","created_at":"2017-02-08T19:04:06Z","updated_at":"2017-02-08T19:06:13Z","html_url":"https://github.com/rails/rails/pull/27947#discussion_r100143171","pull_request_url":"https://api.github.com/repos/rails/rails/pulls/27947","_links":{"self":{"href":"https://api.github.com/repos/rails/rails/pulls/comments/100143171"},"html":{"href":"https://github.com/rails/rails/pull/27947#discussion_r100143171"},"pull_request":{"href":"https://api.github.com/repos/rails/rails/pulls/27947"}}},"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/27947","id":105279535,"html_url":"https://github.com/rails/rails/pull/27947","diff_url":"https://github.com/rails/rails/pull/27947.diff","patch_url":"https://github.com/rails/rails/pull/27947.patch","issue_url":"https://api.github.com/repos/rails/rails/issues/27947","number":27947,"state":"open","locked":false,"title":"Disallow raw SQL in dangerous AR methods","user":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"body":"Some AR methods allow raw SQL where raw SQL is rarely necessary. This opens up applications to SQL injection vulnerabilities when a developer unwittingly passes params or a model attribute to the AR method.\r\n\r\nCode like this looks innocuous, though it actually is an exploitable SQL injection vulnerability:\r\n\r\n```ruby\r\nclass PostsController < ApplicationController\r\n  def index\r\n    @posts = Posts.order(params[:order_by]).limit(10)\r\n  end\r\nend\r\n``` \r\n\r\nA probably-not-comprehensive list of such dangerous APIs can be found at http://rails-sqli.org/.\r\n\r\nThese APIs should be changed to not allow raw SQL. In the rare case where raw SQL *is* needed, the developer should be forced to acknowledge the risk by using an API whose name indicates the danger.\r\n\r\nThis would be a breaking change though, which I'm assuming would not be acceptable. This PR adds an AR config flag that, when enabled, restricts the arguments that can be passed to previously dangerous AR APIs. The previous functionality can be accessed using `unsafe_raw_` prefixed APIs.\r\n\r\nThese changes take a bit of work, so I'm opening this PR early for discussion. So far, I've made changes to the `#pluck`, `#order` and `#reorder` APIs.\r\n\r\nI'll be curious to hear what folks think about the idea. I'm happy to try a different approach if anyone has suggestions, but it would be really good to remove some sharp edges from AR.","created_at":"2017-02-08T18:47:59Z","updated_at":"2017-02-08T19:06:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"fb723c1f6d6faf90f86f8d9fa46f095606472a26","assignee":{"login":"eileencodes","id":1080678,"avatar_url":"https://avatars.githubusercontent.com/u/1080678?v=3","gravatar_id":"","url":"https://api.github.com/users/eileencodes","html_url":"https://github.com/eileencodes","followers_url":"https://api.github.com/users/eileencodes/followers","following_url":"https://api.github.com/users/eileencodes/following{/other_user}","gists_url":"https://api.github.com/users/eileencodes/gists{/gist_id}","starred_url":"https://api.github.com/users/eileencodes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eileencodes/subscriptions","organizations_url":"https://api.github.com/users/eileencodes/orgs","repos_url":"https://api.github.com/users/eileencodes/repos","events_url":"https://api.github.com/users/eileencodes/events{/privacy}","received_events_url":"https://api.github.com/users/eileencodes/received_events","type":"User","site_admin":true},"assignees":[{"login":"eileencodes","id":1080678,"avatar_url":"https://avatars.githubusercontent.com/u/1080678?v=3","gravatar_id":"","url":"https://api.github.com/users/eileencodes","html_url":"https://github.com/eileencodes","followers_url":"https://api.github.com/users/eileencodes/followers","following_url":"https://api.github.com/users/eileencodes/following{/other_user}","gists_url":"https://api.github.com/users/eileencodes/gists{/gist_id}","starred_url":"https://api.github.com/users/eileencodes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eileencodes/subscriptions","organizations_url":"https://api.github.com/users/eileencodes/orgs","repos_url":"https://api.github.com/users/eileencodes/repos","events_url":"https://api.github.com/users/eileencodes/events{/privacy}","received_events_url":"https://api.github.com/users/eileencodes/received_events","type":"User","site_admin":true}],"milestone":null,"commits_url":"https://api.github.com/repos/rails/rails/pulls/27947/commits","review_comments_url":"https://api.github.com/repos/rails/rails/pulls/27947/comments","review_comment_url":"https://api.github.com/repos/rails/rails/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rails/rails/issues/27947/comments","statuses_url":"https://api.github.com/repos/rails/rails/statuses/30ecd74c870344df3c1a0f02853836fb7bd2e86d","head":{"label":"mastahyeti:unsafe_raw_sql","ref":"unsafe_raw_sql","sha":"30ecd74c870344df3c1a0f02853836fb7bd2e86d","user":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"repo":{"id":81358591,"name":"rails","full_name":"mastahyeti/rails","owner":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"private":false,"html_url":"https://github.com/mastahyeti/rails","description":"Ruby on Rails","fork":true,"url":"https://api.github.com/repos/mastahyeti/rails","forks_url":"https://api.github.com/repos/mastahyeti/rails/forks","keys_url":"https://api.github.com/repos/mastahyeti/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mastahyeti/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mastahyeti/rails/teams","hooks_url":"https://api.github.com/repos/mastahyeti/rails/hooks","issue_events_url":"https://api.github.com/repos/mastahyeti/rails/issues/events{/number}","events_url":"https://api.github.com/repos/mastahyeti/rails/events","assignees_url":"https://api.github.com/repos/mastahyeti/rails/assignees{/user}","branches_url":"https://api.github.com/repos/mastahyeti/rails/branches{/branch}","tags_url":"https://api.github.com/repos/mastahyeti/rails/tags","blobs_url":"https://api.github.com/repos/mastahyeti/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mastahyeti/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mastahyeti/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/mastahyeti/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mastahyeti/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/mastahyeti/rails/languages","stargazers_url":"https://api.github.com/repos/mastahyeti/rails/stargazers","contributors_url":"https://api.github.com/repos/mastahyeti/rails/contributors","subscribers_url":"https://api.github.com/repos/mastahyeti/rails/subscribers","subscription_url":"https://api.github.com/repos/mastahyeti/rails/subscription","commits_url":"https://api.github.com/repos/mastahyeti/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/mastahyeti/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/mastahyeti/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/mastahyeti/rails/issues/comments{/number}","contents_url":"https://api.github.com/repos/mastahyeti/rails/contents/{+path}","compare_url":"https://api.github.com/repos/mastahyeti/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mastahyeti/rails/merges","archive_url":"https://api.github.com/repos/mastahyeti/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mastahyeti/rails/downloads","issues_url":"https://api.github.com/repos/mastahyeti/rails/issues{/number}","pulls_url":"https://api.github.com/repos/mastahyeti/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/mastahyeti/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/mastahyeti/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mastahyeti/rails/labels{/name}","releases_url":"https://api.github.com/repos/mastahyeti/rails/releases{/id}","deployments_url":"https://api.github.com/repos/mastahyeti/rails/deployments","created_at":"2017-02-08T17:51:49Z","updated_at":"2017-02-08T17:52:28Z","pushed_at":"2017-02-08T18:24:43Z","git_url":"git://github.com/mastahyeti/rails.git","ssh_url":"git@github.com:mastahyeti/rails.git","clone_url":"https://github.com/mastahyeti/rails.git","svn_url":"https://github.com/mastahyeti/rails","homepage":"http://rubyonrails.org","size":142765,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rails:master","ref":"master","sha":"e2b425bc741d19308f98fed1103bf7d66c8cad2d","user":{"login":"rails","id":4223,"avatar_url":"https://avatars.githubusercontent.com/u/4223?v=3","gravatar_id":"","url":"https://api.github.com/users/rails","html_url":"https://github.com/rails","followers_url":"https://api.github.com/users/rails/followers","following_url":"https://api.github.com/users/rails/following{/other_user}","gists_url":"https://api.github.com/users/rails/gists{/gist_id}","starred_url":"https://api.github.com/users/rails/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rails/subscriptions","organizations_url":"https://api.github.com/users/rails/orgs","repos_url":"https://api.github.com/users/rails/repos","events_url":"https://api.github.com/users/rails/events{/privacy}","received_events_url":"https://api.github.com/users/rails/received_events","type":"Organization","site_admin":false},"repo":{"id":8514,"name":"rails","full_name":"rails/rails","owner":{"login":"rails","id":4223,"avatar_url":"https://avatars.githubusercontent.com/u/4223?v=3","gravatar_id":"","url":"https://api.github.com/users/rails","html_url":"https://github.com/rails","followers_url":"https://api.github.com/users/rails/followers","following_url":"https://api.github.com/users/rails/following{/other_user}","gists_url":"https://api.github.com/users/rails/gists{/gist_id}","starred_url":"https://api.github.com/users/rails/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rails/subscriptions","organizations_url":"https://api.github.com/users/rails/orgs","repos_url":"https://api.github.com/users/rails/repos","events_url":"https://api.github.com/users/rails/events{/privacy}","received_events_url":"https://api.github.com/users/rails/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rails/rails","description":"Ruby on Rails","fork":false,"url":"https://api.github.com/repos/rails/rails","forks_url":"https://api.github.com/repos/rails/rails/forks","keys_url":"https://api.github.com/repos/rails/rails/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rails/rails/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rails/rails/teams","hooks_url":"https://api.github.com/repos/rails/rails/hooks","issue_events_url":"https://api.github.com/repos/rails/rails/issues/events{/number}","events_url":"https://api.github.com/repos/rails/rails/events","assignees_url":"https://api.github.com/repos/rails/rails/assignees{/user}","branches_url":"https://api.github.com/repos/rails/rails/branches{/branch}","tags_url":"https://api.github.com/repos/rails/rails/tags","blobs_url":"https://api.github.com/repos/rails/rails/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rails/rails/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rails/rails/git/refs{/sha}","trees_url":"https://api.github.com/repos/rails/rails/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rails/rails/statuses/{sha}","languages_url":"https://api.github.com/repos/rails/rails/languages","stargazers_url":"https://api.github.com/repos/rails/rails/stargazers","contributors_url":"https://api.github.com/repos/rails/rails/contributors","subscribers_url":"https://api.github.com/repos/rails/rails/subscribers","subscription_url":"https://api.github.com/repos/rails/rails/subscription","commits_url":"https://api.github.com/repos/rails/rails/commits{/sha}","git_commits_url":"https://api.github.com/repos/rails/rails/git/commits{/sha}","comments_url":"https://api.github.com/repos/rails/rails/comments{/number}","issue_comment_url":"https://api.github.com/repos/rails/rails/issues/comments{/number}","contents_url":"https://api.github.com/repos/rails/rails/contents/{+path}","compare_url":"https://api.github.com/repos/rails/rails/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rails/rails/merges","archive_url":"https://api.github.com/repos/rails/rails/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rails/rails/downloads","issues_url":"https://api.github.com/repos/rails/rails/issues{/number}","pulls_url":"https://api.github.com/repos/rails/rails/pulls{/number}","milestones_url":"https://api.github.com/repos/rails/rails/milestones{/number}","notifications_url":"https://api.github.com/repos/rails/rails/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rails/rails/labels{/name}","releases_url":"https://api.github.com/repos/rails/rails/releases{/id}","deployments_url":"https://api.github.com/repos/rails/rails/deployments","created_at":"2008-04-11T02:19:47Z","updated_at":"2017-02-08T19:01:25Z","pushed_at":"2017-02-08T18:48:00Z","git_url":"git://github.com/rails/rails.git","ssh_url":"git@github.com:rails/rails.git","clone_url":"https://github.com/rails/rails.git","svn_url":"https://github.com/rails/rails","homepage":"http://rubyonrails.org","size":142800,"stargazers_count":34397,"watchers_count":34397,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":14008,"mirror_url":null,"open_issues_count":1249,"forks":14008,"open_issues":1249,"watchers":34397,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rails/rails/pulls/27947"},"html":{"href":"https://github.com/rails/rails/pull/27947"},"issue":{"href":"https://api.github.com/repos/rails/rails/issues/27947"},"comments":{"href":"https://api.github.com/repos/rails/rails/issues/27947/comments"},"review_comments":{"href":"https://api.github.com/repos/rails/rails/pulls/27947/comments"},"review_comment":{"href":"https://api.github.com/repos/rails/rails/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rails/rails/pulls/27947/commits"},"statuses":{"href":"https://api.github.com/repos/rails/rails/statuses/30ecd74c870344df3c1a0f02853836fb7bd2e86d"}}}}
{"actor":{"display_login":"eileencodes"}}