Use bind variables for table_comment column_comment foreign_keys

lib/active_record/connection_adapters/oracle_enhanced/schema_statements.rb

@@ -329,10 +329,10 @@ def change_column_comment(table_name, column_name, comment) #:nodoc:
 
         def table_comment(table_name) #:nodoc:
           (owner, table_name, db_link) = @connection.describe(table_name)
-          select_value <<-SQL
+          select_value(<<-SQL, "Table comment", [bind_string("owner", owner), bind_string("table_name", table_name)])
             SELECT comments FROM all_tab_comments#{db_link}
-            WHERE owner = '#{owner}'
-              AND table_name = '#{table_name}'
+            WHERE owner = :owner
+              AND table_name = :table_name
           SQL
         end
 
@@ -345,11 +345,11 @@ def table_options(table_name) # :nodoc:
         def column_comment(table_name, column_name) #:nodoc:
           # TODO: it  does not exist in Abstract adapter
           (owner, table_name, db_link) = @connection.describe(table_name)
-          select_value <<-SQL
+          select_value(<<-SQL, "Column comment", [bind_string("owner", owner), bind_string("table_name", table_name), bind_string("column_name", column_name.upcase)])
             SELECT comments FROM all_col_comments#{db_link}
-            WHERE owner = '#{owner}'
-              AND table_name = '#{table_name}'
-              AND column_name = '#{column_name.upcase}'
+            WHERE owner = :owner
+              AND table_name = :table_name
+              AND column_name = :column_name
           SQL
         end
 
@@ -374,16 +374,16 @@ def tablespace(table_name)
         def foreign_keys(table_name) #:nodoc:
           (owner, desc_table_name, db_link) = @connection.describe(table_name)
 
-          fk_info = select_all(<<-SQL, "Foreign Keys")
+          fk_info = select_all(<<-SQL, "Foreign Keys", [bind_string("owner", owner), bind_string("desc_table_name", desc_table_name)])
             SELECT r.table_name to_table
                   ,rc.column_name references_column
                   ,cc.column_name
                   ,c.constraint_name name
                   ,c.delete_rule
               FROM all_constraints#{db_link} c, all_cons_columns#{db_link} cc,
                    all_constraints#{db_link} r, all_cons_columns#{db_link} rc
-             WHERE c.owner = '#{owner}'
-               AND c.table_name = q'[#{desc_table_name}]'
+             WHERE c.owner = :owner
+               AND c.table_name = :desc_table_name
                AND c.constraint_type = 'R'
                AND cc.owner = c.owner
                AND cc.constraint_name = c.constraint_name
@@ -508,11 +508,12 @@ def rebuild_primary_key_index_to_default_tablespace(table_name, options)
 
             return unless tablespace
 
-            index_name = Base.connection.select_value(
-              "SELECT index_name FROM all_constraints
-                  WHERE table_name = #{quote(table_name.upcase)}
+            index_name = select_value(<<-SQL, "Index name for primary key",  [bind_string("table_name", table_name.upcase)])
+              SELECT index_name FROM all_constraints
+                  WHERE table_name = :table_name
                   AND constraint_type = 'P'
-                  AND owner = SYS_CONTEXT('userenv', 'current_schema')")
+                  AND owner = SYS_CONTEXT('userenv', 'current_schema')
+            SQL
 
             return unless index_name
 

spec/active_record/connection_adapters/oracle_enhanced/schema_statements_spec.rb

@@ -334,7 +334,13 @@ def create_test_employees_table(table_comment = nil, column_comments = {})
       @conn = ActiveRecord::Base.connection
     end
 
+    before(:each) do
+      @conn.clear_cache!
+      set_logger
+    end
+
     after(:each) do
+      clear_logger
       schema_define do
         drop_table :test_employees
       end
@@ -347,7 +353,6 @@ def create_test_employees_table(table_comment = nil, column_comments = {})
       table_comment = "Test Employees"
       create_test_employees_table(table_comment)
       class ::TestEmployee < ActiveRecord::Base; end
-
       expect(@conn.table_comment("test_employees")).to eq(table_comment)
     end
 
@@ -380,6 +385,28 @@ class ::TestEmployee < ActiveRecord::Base; end
       end
     end
 
+    it "should query table_comment using bind variables" do
+      table_comment = "Test Employees"
+      create_test_employees_table(table_comment)
+      class ::TestEmployee < ActiveRecord::Base; end
+      expect(@conn.table_comment(TestEmployee.table_name)).to eq(table_comment)
+      expect(@logger.logged(:debug).last).to match(/:owner/)
+      expect(@logger.logged(:debug).last).to match(/:table_name/)
+      expect(@logger.logged(:debug).last).to match(/\[\["owner", "#{DATABASE_USER.upcase}"\], \["table_name", "TEST_EMPLOYEES"\]\]/)
+    end
+
+    it "should query column_comment using bind variables" do
+      table_comment = "Test Employees"
+      column_comment = { first_name: "Given Name" }
+      create_test_employees_table(table_comment, column_comment)
+      class ::TestEmployee < ActiveRecord::Base; end
+      expect(@conn.column_comment(TestEmployee.table_name, :first_name)).to eq(column_comment[:first_name])
+      expect(@logger.logged(:debug).last).to match(/:owner/)
+      expect(@logger.logged(:debug).last).to match(/:table_name/)
+      expect(@logger.logged(:debug).last).to match(/:column_name/)
+      expect(@logger.logged(:debug).last).to match(/\[\["owner", "#{DATABASE_USER.upcase}"\], \["table_name", "TEST_EMPLOYEES"\], \["column_name", "FIRST_NAME"\]\]/)
+    end
+
   end
 
   describe "drop tables" do
@@ -608,6 +635,7 @@ class ::TestPost < ActiveRecord::Base
       class ::TestComment < ActiveRecord::Base
         belongs_to :test_post
       end
+      set_logger
     end
 
     after(:each) do
@@ -620,6 +648,7 @@ class ::TestComment < ActiveRecord::Base
       ActiveRecord::Base.table_name_prefix = ""
       ActiveRecord::Base.table_name_suffix = ""
       ActiveRecord::Base.clear_cache!
+      clear_logger
     end
 
     it "should add foreign key" do
@@ -703,6 +732,18 @@ class ::TestComment < ActiveRecord::Base
       end.not_to raise_error
     end
 
+    it "should query foreign_keys using bind variables" do
+      fk_name = "fk_rails_#{Digest::SHA256.hexdigest("test_comments_test_post_id_fk").first(10)}"
+
+      schema_define do
+        add_foreign_key :test_comments, :test_posts
+      end
+      ActiveRecord::Base.connection.foreign_keys(:test_comments)
+      expect(@logger.logged(:debug).last).to match(/:owner/)
+      expect(@logger.logged(:debug).last).to match(/:desc_table_name/)
+      expect(@logger.logged(:debug).last).to match(/\[\["owner", "#{DATABASE_USER.upcase}"\], \["desc_table_name", "TEST_COMMENTS"\]\]/)
+    end
+
   end
 
   describe "lob in table definition" do