CVE-2018-18476: mysql-bunuuid-rails vulnerable to SQL injection

The vulnerability stemmed from improper input validation in the serialize method handling UUID conversion. The pre-patch implementation in lib/mysql-binuuid/type.rb's serialize method removed UUID dashes but didn't validate if the result was a valid 32-character hexadecimal string. This allowed attackers to inject arbitrary SQL through malformed UUID values, as ActiveRecord's Binary type relies on implicit hex conversion for safety. The fix added a regex validation (valid_undashed_uuid?) to enforce hexadecimal format, which confirms this was the vulnerable point. The added test cases explicitly demonstrate SQL injection prevention through this validation.