rails/rails — pull request #6971 by dmathieu (2012-07-05 11:28:43+00:00)
Title: fix querying with an empty hash

Suppose the following query :

User.where(token: params[:token])

If `params[:token]` equals "abc", the generated sql query will be the following :

SELECT * FROM users WHERE token = 'abc';

However, if `params[:token]` equals {}, the generated sql query will be :

SELECT * FROM users;

This can actually be a security issue on some applications.

My patch transforms empty hash conditions to :

SELECT * FROM users WHERE users.id IS NULL;

This may not be the best way around this issue. But I'm willing to improve it depending of the feedback provided here.