datamapper/dm-do-adapter — pull request #15 by d11wtq (2012-06-06 11:40:48+00:00)
Title: Security vulnerability fixed - it is possible to cause the WHERE clause of a query to be omitted

Rack parses some request value as `[nil]` (an array containing the value `nil`). When this value is used in a DataMapper query, DM executes the query without a where clause.

An example might be resetting the password of a user account for a given email:

``` ruby
User.first(:email => params[:email]).reset_password!
```

If the user crafts a request that Rack parses `params[:email]` to `[nil]`, no WHERE clause is applied to the query (you would expect `WHERE email IN (NULL)`. This becomes particularly bad with an `#all` query, which would simply return all records in the database.

The issue stems for the use of `!value.any?`, instead of `value.empty?` to check if the `IN` clause has no values in it. This is incorrect, since `#any?` returns false of the array contains only falsy values.

AFAIK, AR was affected by a similar bug that is now fixed: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675429 and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675396