Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove dangerous query method warning #2922

Conversation

potomak
Copy link

@potomak potomak commented Oct 19, 2018

Warning message:

DEPRECATION WARNING: Dangerous query method (method whose arguments
are used as raw SQL) called with non-attribute argument(s):
"coalesce(spree_shipments.shipped_at, spree_shipments.created_at)
desc". Non-attribute arguments will be disallowed in Rails 6.0.
This method should not be called with user-provided values, such as
request parameters or model attributes. Known-safe values can be
passed by wrapping them in Arel.sql(). (called from block in
<class:Shipment> at solidus/core/app/models/spree/shipment.rb:37)

SQL generated by the scope before this update:

> Spree::Shipment.reverse_chronological.to_sql
 => "SELECT \"spree_shipments\".* FROM \"spree_shipments\" ORDER BY
  coalesce(spree_shipments.shipped_at, spree_shipments.created_at)
  desc, \"spree_shipments\".\"id\" DESC"

SQL generated by the scope after this update:

> Spree::Shipment.reverse_chronological.to_sql
 => "SELECT \"spree_shipments\".* FROM \"spree_shipments\" ORDER BY
  COALESCE(\"spree_shipments\".\"shipped_at\",
  \"spree_shipments\".\"created_at\") DESC,
  \"spree_shipments\".\"id\" DESC"

Warning message:

    DEPRECATION WARNING: Dangerous query method (method whose arguments
    are used as raw SQL) called with non-attribute argument(s):
    "coalesce(spree_shipments.shipped_at, spree_shipments.created_at)
    desc". Non-attribute arguments will be disallowed in Rails 6.0.
    This method should not be called with user-provided values, such as
    request parameters or model attributes. Known-safe values can be
    passed by wrapping them in Arel.sql(). (called from block in
    <class:Shipment> at solidus/core/app/models/spree/shipment.rb:37)

SQL generated by the scope before this update:

    > Spree::Shipment.reverse_chronological.to_sql
     => "SELECT \"spree_shipments\".* FROM \"spree_shipments\" ORDER BY
      coalesce(spree_shipments.shipped_at, spree_shipments.created_at)
      desc, \"spree_shipments\".\"id\" DESC"

SQL generated by the scope after this update:

    > Spree::Shipment.reverse_chronological.to_sql
     => "SELECT \"spree_shipments\".* FROM \"spree_shipments\" ORDER BY
      COALESCE(\"spree_shipments\".\"shipped_at\",
      \"spree_shipments\".\"created_at\") DESC,
      \"spree_shipments\".\"id\" DESC"
@potomak
Copy link
Author

potomak commented Oct 19, 2018

The same issue has been addressed by #2921. The approach is slightly different, but both PRs fix this deprecation warning.

@kennyadsl
Copy link
Member

I'm sure this is a great way to fix the issue but I'm not an Arel expert so I'm more for the easier to understand solution provided in #2921 . But let's wait to see if we have other opinions here.

In the meantime thanks for the contribution!

@potomak potomak closed this Oct 23, 2018
@potomak potomak deleted the remove-dangerous-query-method-warning branch October 23, 2018 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants