CVE-2017-20166 (published 2023-01-10T06:15Z)

Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/elixir-ecto/ecto
commit_details: repo_url: https://github.com/elixir-ecto/ecto
author: José Valim
author_date: 2017-08-27 18:46:25+02:00
msg: Revert "Add support for clauses with nil values in `Repo.get_by(!)/2` (#2125)"

This reverts commit 8e1b378a6f79b0f26495578e57f896d3361c808a.
repository: repo_url: https://github.com/elixir-ecto/ecto
repo_name: elixir-ecto/ecto
description: A toolkit for data mapping and language integrated query.
repo_language: Elixir
owner: elixir-ecto
file_changes: filename: repo.exs
change_type: ModificationType.MODIFY
diff: @@ -601,7 +601,6 @@ defmodule Ecto.Integration.RepoTest do
   test "get_by(!)" do
     post1 = TestRepo.insert!(%Post{title: "1", text: "hai"})
     post2 = TestRepo.insert!(%Post{title: "2", text: "hello"})
-    post3 = TestRepo.insert!(%Post{title: "3", text: nil})
 
     assert post1 == TestRepo.get_by(Post, id: post1.id)
     assert post1 == TestRepo.get_by(Post, text: post1.text)
@@ -609,13 +608,11 @@ defmodule Ecto.Integration.RepoTest do
     assert post2 == TestRepo.get_by(Post, id: to_string(post2.id)) # With casting
     assert nil   == TestRepo.get_by(Post, text: "hey")
     assert nil   == TestRepo.get_by(Post, id: post2.id, text: "hey")
-    assert post3 == TestRepo.get_by(Post, text: nil)
 
     assert post1 == TestRepo.get_by!(Post, id: post1.id)
     assert post1 == TestRepo.get_by!(Post, text: post1.text)
     assert post1 == TestRepo.get_by!(Post, id: post1.id, text: post1.text)
     assert post2 == TestRepo.get_by!(Post, id: to_string(post2.id)) # With casting
-    assert post3 == TestRepo.get_by!(Post, text: nil)
 
     assert post1 == TestRepo.get_by!(Post, %{id: post1.id})
 

programming_language: Python
filename: queryable.ex
change_type: ModificationType.MODIFY
diff: @@ -347,12 +347,7 @@ defmodule Ecto.Repo.Queryable do
   end
 
   defp query_for_get_by(_repo, queryable, clauses) do
-    Enum.reduce(clauses, queryable, fn
-      ({key, nil}, query) ->
-        Query.where(query, [x], is_nil(field(x, ^key)))
-      ({key, value}, query) ->
-        Query.where(query, [x], field(x, ^key) == ^value)
-    end)
+    Query.where(queryable, [], ^Enum.to_list(clauses))
   end
 
   defp query_for_aggregate(queryable, aggregate, field) do

programming_language: Ruby
filename: repo_test.exs
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,6 @@ defmodule Ecto.RepoTest do
   test "validates get_by" do
     TestRepo.get_by(MySchema, id: 123)
     TestRepo.get_by(MySchema, %{id: 123})
-    TestRepo.get_by(MySchema, id: nil)
 
     message = ~r"value `:atom` in `where` cannot be cast to type :id in query"
     assert_raise Ecto.Query.CastError, message, fn ->

programming_language: Python