Skip to content

Conversation

@arielr-lt
Copy link
Collaborator

@arielr-lt arielr-lt commented Oct 31, 2025

Motivation:

See the (first bullet in) CHANGELOG for activerecord gem: https://github.com/rails/rails/blob/v8.0.2.1/activerecord/CHANGELOG.md

CVE-2025-55193 Detail

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

  • In 8.0.2, ActiveRecord raised:
    • raise(... "Couldn't find #{name} with '#{primary_key}'=#{id}")
    • String IDs appeared unquoted (…=wtf).
  • In 8.0.2.1, it switched to:
    • raise(... "Couldn't find #{name} with '#{primary_key}'=#{id.inspect}")
    • String IDs are now quoted (…="wtf"), because inspect adds quotes for strings.

Changes:

  • Standardized 404 errors: Added a global rescue for ActiveRecord::RecordNotFound to return “ not found” (app/api/base.rb)
  • Updated specs to assert on this stable message.

Benefits:

  • Decouples your API from upstream message format changes (like the 8.0.2 → 8.0.2.1 switch to
    id.inspect).
  • Presents consistent, user-friendly errors.

@arielr-lt arielr-lt requested review from edgarf and excelsior October 31, 2025 12:40
@arielr-lt arielr-lt self-assigned this Oct 31, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants