Properly excape prefix and suffix queries

In #196 I added sanitization for `match` filters but I negelected
to handle `prefix` and `suffix` filters, which share similar logic.
This handles all three.  Additionally, issue #207 indicates an issue
with the `sanitize_sql_like` method not always being available on the
scope object. Wasn't able to reproduce myself, but this switches to
avoid using the method from scope directly and instead creates a utility
class which is extended with the appropriate sanitization methods.

Author: wadetandy

lib/graphiti/adapters/active_record.rb

@@ -57,41 +57,28 @@ def filter_string_not_eql(scope, attribute, value)
         filter_string_eql(scope, attribute, value, is_not: true)
       end
 
-      def filter_string_prefix(scope, attribute, value, is_not: false)
-        column = column_for(scope, attribute)
-        map = value.map { |v| "#{v}%" }
-        clause = column.lower.matches_any(map)
-        is_not ? scope.where.not(clause) : scope.where(clause)
-      end
-
-      def filter_string_not_prefix(scope, attribute, value)
-        filter_string_prefix(scope, attribute, value, is_not: true)
-      end
-
-      def filter_string_suffix(scope, attribute, value, is_not: false)
-        column = column_for(scope, attribute)
-        map = value.map { |v| "%#{v}" }
-        clause = column.lower.matches_any(map)
-        is_not ? scope.where.not(clause) : scope.where(clause)
-      end
-
-      def filter_string_not_suffix(scope, attribute, value)
-        filter_string_suffix(scope, attribute, value, is_not: true)
-      end
-
       # Arel has different match escaping behavior before rails 5.
       # Since rails 4.x does not expose methods to escape LIKE statements
       # anyway, we just don't support proper LIKE escaping in those versions.
       if ::ActiveRecord.version >= Gem::Version.new("5.0.0")
         def filter_string_match(scope, attribute, value, is_not: false)
-          escape_char = '\\'
-          column = column_for(scope, attribute)
-          map = value.map { |v|
-            v = v.downcase
-            v = scope.sanitize_sql_like(v)
+          clause = sanitized_like_for(scope, attribute, value) do |v|
             "%#{v}%"
-          }
-          clause = column.lower.matches_any(map, escape_char, true)
+          end
+          is_not ? scope.where.not(clause) : scope.where(clause)
+        end
+
+        def filter_string_prefix(scope, attribute, value, is_not: false)
+          clause = sanitized_like_for(scope, attribute, value) do |v|
+            "#{v}%"
+          end
+          is_not ? scope.where.not(clause) : scope.where(clause)
+        end
+
+        def filter_string_suffix(scope, attribute, value, is_not: false)
+          clause = sanitized_like_for(scope, attribute, value) do |v|
+            "%#{v}"
+          end
           is_not ? scope.where.not(clause) : scope.where(clause)
         end
       else
@@ -103,6 +90,28 @@ def filter_string_match(scope, attribute, value, is_not: false)
           clause = column.lower.matches_any(map)
           is_not ? scope.where.not(clause) : scope.where(clause)
         end
+
+        def filter_string_prefix(scope, attribute, value, is_not: false)
+          column = column_for(scope, attribute)
+          map = value.map { |v| "#{v}%" }
+          clause = column.lower.matches_any(map)
+          is_not ? scope.where.not(clause) : scope.where(clause)
+        end
+
+        def filter_string_suffix(scope, attribute, value, is_not: false)
+          column = column_for(scope, attribute)
+          map = value.map { |v| "%#{v}" }
+          clause = column.lower.matches_any(map)
+          is_not ? scope.where.not(clause) : scope.where(clause)
+        end
+      end
+
+      def filter_string_not_prefix(scope, attribute, value)
+        filter_string_prefix(scope, attribute, value, is_not: true)
+      end
+
+      def filter_string_not_suffix(scope, attribute, value)
+        filter_string_suffix(scope, attribute, value, is_not: true)
       end
 
       def filter_string_not_match(scope, attribute, value)
@@ -298,6 +307,22 @@ def column_for(scope, name)
           table[name]
         end
       end
+
+      def sanitized_like_for(scope, attribute, value, &block)
+        escape_char = '\\'
+        column = column_for(scope, attribute)
+        map = value.map do |v|
+          v = v.downcase
+          v = Sanitizer.sanitize_sql_like(v)
+          block.call v
+        end
+
+        column.lower.matches_any(map, escape_char, true)
+      end
+
+      class Sanitizer
+        extend ::ActiveRecord::Sanitization::ClassMethods
+      end
     end
   end
 end

spec/integration/rails/finders_spec.rb

@@ -231,6 +231,24 @@ def resource
           it "executes case-insensitive prefix query" do
             expect(ids).to eq([author2.id, author3.id])
           end
+
+          if ::ActiveRecord.version >= Gem::Version.new("5.0")
+            context 'when match string includes % characters' do
+              let(:value) { {prefix: "%ild"} }
+
+              let!(:author_with_percent) do
+                Legacy::Author.create!(first_name: "%ildcard")
+              end
+
+              let!(:normal_author) do
+                Legacy::Author.create!(first_name: "wildcard")
+              end
+
+              it "does not use the provided % as a wildcard character" do
+                expect(ids).to eq([author_with_percent.id])
+              end
+            end
+          end
         end
 
         context "!prefix" do
@@ -247,6 +265,24 @@ def resource
           it "executes case-insensitive suffix query" do
             expect(ids).to eq([author2.id, author3.id])
           end
+
+          if ::ActiveRecord.version >= Gem::Version.new("5.0")
+            context 'when match string includes % characters' do
+              let(:value) { {suffix: "car%"} }
+
+              let!(:author_with_percent) do
+                Legacy::Author.create!(first_name: "Wildcar%")
+              end
+
+              let!(:normal_author) do
+                Legacy::Author.create!(first_name: "Wildcard")
+              end
+
+              it "does not use the provided % as a wildcard character" do
+                expect(ids).to eq([author_with_percent.id])
+              end
+            end
+          end
         end
 
         context "!suffix" do