Skip to content

Commit d76f8fe

Browse files
adamchainzadamchainz
authored
Always cast SQL parameters to tuples (#558)
As reported in #50.
1 parent e4b3a50 commit d76f8fe

File tree

7 files changed

+24
-34
lines changed

7 files changed

+24
-34
lines changed

Diff for: ‎HISTORY.rst

+2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ Pending
1010
1111
* Update Python support to 3.5-3.7, as 3.4 has reached its end of life.
1212

13+
* Always cast SQL params to tuples in ORM code.
14+
1315
3.1.0 (2019-05-17)
1416
------------------
1517

Diff for: ‎django_mysql/models/aggregates.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,4 @@ def as_sql(self, compiler, connection, function=None, template=None):
6464

6565
sql.append(")")
6666

67-
return "".join(sql), params
67+
return "".join(sql), tuple(params)

Diff for: ‎django_mysql/models/expressions.py

+6-18
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,7 @@ def as_sql(self, compiler, connection):
6464
value, value_params = compiler.compile(self.rhs)
6565

6666
sql = self.sql_expression % (field, value)
67-
68-
params = []
69-
params.extend(value_params)
70-
params.extend(field_params)
67+
params = tuple(value_params) + tuple(field_params)
7168

7269
return sql, params
7370

@@ -96,10 +93,7 @@ def as_sql(self, compiler, connection):
9693
value, value_params = compiler.compile(self.rhs)
9794

9895
sql = self.sql_expression % (value, field)
99-
100-
params = []
101-
params.extend(field_params)
102-
params.extend(value_params)
96+
params = tuple(field_params) + tuple(value_params)
10397

10498
return sql, params
10599

@@ -136,7 +130,7 @@ def as_sql(self, compiler, connection):
136130
field, field_params = compiler.compile(self.lhs)
137131

138132
sql = self.sql_expression % (field)
139-
return sql, field_params
133+
return sql, tuple(field_params)
140134

141135

142136
class PopLeftListF(BaseExpression):
@@ -163,7 +157,7 @@ def as_sql(self, compiler, connection):
163157
field, field_params = compiler.compile(self.lhs)
164158

165159
sql = self.sql_expression % (field)
166-
return sql, field_params
160+
return sql, tuple(field_params)
167161

168162

169163
class SetF(object):
@@ -206,10 +200,7 @@ def as_sql(self, compiler, connection):
206200
value, value_params = compiler.compile(self.rhs)
207201

208202
sql = self.sql_expression % (value, field)
209-
210-
params = []
211-
params.extend(value_params)
212-
params.extend(field_params)
203+
params = tuple(value_params) + tuple(field_params)
213204

214205
return sql, params
215206

@@ -257,9 +248,6 @@ def as_sql(self, compiler, connection):
257248
value, value_params = compiler.compile(self.rhs)
258249

259250
sql = self.sql_expression % (value, field)
260-
261-
params = []
262-
params.extend(value_params)
263-
params.extend(field_params)
251+
params = tuple(value_params) + tuple(field_params)
264252

265253
return sql, params

Diff for: ‎django_mysql/models/fields/dynamic.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ def as_sql(self, compiler, connection):
299299
lhs, params = compiler.compile(self.lhs)
300300
return (
301301
"COLUMN_GET({}, %s AS {})".format(lhs, self.data_type),
302-
params + [self.key_name],
302+
tuple(params) + (self.key_name,),
303303
)
304304

305305

Diff for: ‎django_mysql/models/fields/json.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ def as_sql(self, compiler, connection):
207207

208208
json_path = self.compile_json_path(key_transforms)
209209

210-
return 'JSON_EXTRACT({}, %s)'.format(lhs), params + [json_path]
210+
return 'JSON_EXTRACT({}, %s)'.format(lhs), tuple(params) + (json_path,)
211211

212212
def compile_json_path(self, key_transforms):
213213
path = ['$']

Diff for: ‎django_mysql/models/fields/lists.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ def __init__(self, index, *args, **kwargs):
228228
def as_sql(self, qn, connection):
229229
lhs, lhs_params = self.process_lhs(qn, connection)
230230
rhs, rhs_params = self.process_rhs(qn, connection)
231-
params = lhs_params + rhs_params
231+
params = tuple(lhs_params) + tuple(rhs_params)
232232
# Put rhs on the left since that's the order FIND_IN_SET uses
233233
return '(FIND_IN_SET(%s, %s) = %s)' % (rhs, lhs, self.index), params
234234

Diff for: ‎django_mysql/models/lookups.py

+12-12
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ class SoundsLike(Lookup):
2020
def as_sql(self, qn, connection):
2121
lhs, lhs_params = self.process_lhs(qn, connection)
2222
rhs, rhs_params = self.process_rhs(qn, connection)
23-
params = lhs_params + rhs_params
23+
params = tuple(lhs_params) + tuple(rhs_params)
2424
return '%s SOUNDS LIKE %s' % (lhs, rhs), params
2525

2626

@@ -73,7 +73,7 @@ class JSONContainedBy(Lookup):
7373
def as_sql(self, qn, connection):
7474
lhs, lhs_params = self.process_lhs(qn, connection)
7575
rhs, rhs_params = self.process_rhs(qn, connection)
76-
params = rhs_params + lhs_params
76+
params = tuple(rhs_params) + tuple(lhs_params)
7777
return 'JSON_CONTAINS({}, {})'.format(rhs, lhs), params
7878

7979

@@ -83,7 +83,7 @@ class JSONContains(JSONLookupMixin, Lookup):
8383
def as_sql(self, qn, connection):
8484
lhs, lhs_params = self.process_lhs(qn, connection)
8585
rhs, rhs_params = self.process_rhs(qn, connection)
86-
params = lhs_params + rhs_params
86+
params = tuple(lhs_params) + tuple(rhs_params)
8787
return 'JSON_CONTAINS({}, {})'.format(lhs, rhs), params
8888

8989

@@ -101,7 +101,7 @@ def as_sql(self, qn, connection):
101101
lhs, lhs_params = self.process_lhs(qn, connection)
102102
key_name = self.rhs
103103
path = '$.{}'.format(json.dumps(key_name))
104-
params = lhs_params + [path]
104+
params = tuple(lhs_params) + (path,)
105105
return "JSON_CONTAINS_PATH({}, 'one', %s)".format(lhs), params
106106

107107

@@ -120,11 +120,11 @@ class JSONHasKeys(JSONSequencesMixin, Lookup):
120120

121121
def as_sql(self, qn, connection):
122122
lhs, lhs_params = self.process_lhs(qn, connection)
123-
paths = [
123+
paths = tuple(
124124
'$.{}'.format(json.dumps(key_name))
125125
for key_name in self.rhs
126-
]
127-
params = lhs_params + paths
126+
)
127+
params = tuple(lhs_params) + paths
128128

129129
sql = ['JSON_CONTAINS_PATH(', lhs, ", 'all', "]
130130
sql.append(', '.join('%s' for _ in paths))
@@ -137,11 +137,11 @@ class JSONHasAnyKeys(JSONSequencesMixin, Lookup):
137137

138138
def as_sql(self, qn, connection):
139139
lhs, lhs_params = self.process_lhs(qn, connection)
140-
paths = [
140+
paths = tuple(
141141
'$.{}'.format(json.dumps(key_name))
142142
for key_name in self.rhs
143-
]
144-
params = lhs_params + paths
143+
)
144+
params = tuple(lhs_params) + paths
145145

146146
sql = ['JSON_CONTAINS_PATH(', lhs, ", 'one', "]
147147
sql.append(', '.join('%s' for _ in paths))
@@ -169,7 +169,7 @@ def get_prep_lookup(self):
169169
def as_sql(self, qn, connection):
170170
lhs, lhs_params = self.process_lhs(qn, connection)
171171
rhs, rhs_params = self.process_rhs(qn, connection)
172-
params = lhs_params + rhs_params
172+
params = tuple(lhs_params) + tuple(rhs_params)
173173
# Put rhs on the left since that's the order FIND_IN_SET uses
174174
return 'FIND_IN_SET(%s, %s)' % (rhs, lhs), params
175175

@@ -187,5 +187,5 @@ class DynColHasKey(Lookup):
187187
def as_sql(self, qn, connection):
188188
lhs, lhs_params = self.process_lhs(qn, connection)
189189
rhs, rhs_params = self.process_rhs(qn, connection)
190-
params = lhs_params + rhs_params
190+
params = tuple(lhs_params) + tuple(rhs_params)
191191
return 'COLUMN_EXISTS(%s, %s)' % (lhs, rhs), params

0 commit comments

Comments
 (0)