$ the-wire · showcase
RAILS TIGHTENS SQL SAFETY AND LOGGING CONTROL IN MAINTENANCE PUSH
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
3 people shipped this
Rails shipped five commits across parameter binding, logger filtering, and migration recording that tighten SQL injection prevention and give you finer control over noisy dependencies.
ProxyLogger can now silence specific messages by pattern without raising the global log level [1]. The feature lets you ignore noisy gems with regex or string matching, compiled once at registration time to avoid performance drag on every log call. Meanwhile, `find_by_sql` and `count_by_sql` now route array-form arguments through bind parameters instead of eager interpolation, closing a parity gap with the `where` API [2]. This consolidates placeholder dispatch into a shared `Sanitization#bound_sql_literal_for` method, reducing duplication. Rails also cleaned up test infrastructure by dropping stubs from `FakeKlass` and moving it to real `Sanitization` methods [3], and refactored `CommandRecorder` to store migration command args and kwargs separately instead of bundling them into a trailing hash [4]. The kwargs separation breaks code that inspects `recorder.commands` directly and expects 3-element tuples instead of the new 4-element shape.
Action items
- → Review any code that inspects recorder.commands directly and adapt to [cmd, args, kwargs, block] tuple structure rails/rails [plan]
- → Audit find_by_sql and count_by_sql calls for any custom sanitization workarounds that are now redundant rails/rails [monitor]
- → Consider using ProxyLogger.ignore for verbose dependencies in test or development environments rails/rails [monitor]
References
- [1] Allow ActiveSupport::ProxyLogger to ignore messages by pattern ↗ rails/rails
- [2] Use bind parameters for array-form arguments in `find_by_sql` / `count_by_sql` ↗ rails/rails
- [3] Drop `Sanitization` stubs from `FakeKlass` ↗ rails/rails
- [4] Refactor `CommandRecorder` to store args and kwargs separately ↗ rails/rails
