rails/rails — pull request #16069 by dylanahsmith (2014-07-06 06:16:26+00:00)
Title: active_record: Type cast booleans and durations for string columns.

@rafaelfranca, @sgrif, @arthurnn this is a basically a rebase of pull #14894 which was closed without the problem being completely fixed.

## Problem

Pull #16037 partially fixed the problem is described in [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) by quoting Numeric types, however, it was missing quoting of boolean and ActiveSupport::Duration types.

For example:

```ruby
User.where(:login_token=>params[:token]).first
```
can be exploited by passing in `false` for `params[:token]` through a JSON body causing the query
```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```
to match any login_token that starts with a non-digit character.

Quoting for these additional types was properly handled in mistakenly closed pull request #14894.

## Solution

ActiveRecord::Type::String#type_cast_for_database has been updated to handle these types. Tests are included for these missed types as well as the numeric types which are already quoted properly to prevent regressions.