norman/friendly_id — Issue #197: finder fallback to super is problematic
Author: danieldkim
Created: 2011-12-13 16:32:11+00:00
State: open

friendly_id's override of ActiveRecord#find_one falls back to super if the find by friendly id returns nil. the result of this is that if an invalid friendly id that is passed to find() converts to an integer that matches the (unfriendly) id of an existing object, an incorrect object can be returned. here's an example from my app:

irb(main):002:0> Application.find '81D1E04CC0CC2C200BF8'
Application Load (0.2ms) SELECT `applications`.* FROM `applications` WHERE `applications`.`key` = '81D1E04CC0CC2C200BF8' LIMIT 1
Application Load (0.2ms) SELECT `applications`.* FROM `applications` WHERE `applications`.`id` = 81 LIMIT 1
=> #
irb(main):003:0>

The find() call above should generate an ActiveRecord::RecordNotFound exception. Instead, because the string ''81D1E04CC0CC2C200BF8' converts to the integer 81, and another object exists with an id of 81, the wrong object is returned.