Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding proper escape #87

Merged
merged 4 commits into from
Feb 22, 2024
Merged

Adding proper escape #87

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
21da620
Adding proper escape
mroda88 Feb 22, 2024
17b1e39
changes discussed with Pierre
mroda88 Feb 22, 2024
490819c
Cleaner name
mroda88 Feb 22, 2024
58c2028
explicit formatting
mroda88 Feb 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 9 additions & 17 deletions ers-protobuf-dbwriter/dbwriter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,8 @@ def cli(subscriber_bootstrap, subscriber_group, subscriber_timeout,
user=db_user,
password=db_password,
dbname=db_name)
except:
except Exception as e:
logging.error(e)
logging.fatal('Connection to the database failed, aborting...')
exit()

Expand Down Expand Up @@ -157,30 +158,21 @@ def process_issue( issue, session, cursor ) :
# heavy information
add_entry("inheritance", '/'.join(issue.inheritance), fields, values)
add_entry("message", issue.message, fields, values)
add_entry("params", convert_params(issue.parameters), fields, values)


command = "INSERT INTO " + table_name;
command += " (" + ", ".join(fields) + ')'
command += " VALUES " + repr(tuple(values)) + ';'
add_entry("params", issue.parameters, fields, values)

command = f"INSERT INTO {table_name} ({','.join(fields)}) VALUES ({('%s, ' * len(values))[:-2]});"

logging.debug(command)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you also want to escape field names here. Also why do you need the [:-2]?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

escape the fields, and the table_name

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the [:-2] is to remove the last comma and the last from the string. I'll escape the rest too.

cursor.execute(command)
cursor.execute(command, values)


def convert_params( params ) -> str :
s = str(params)
return s.replace("'", '"')

def add_entry(field, value, fields, values):
fields.append(field)
values.append(value)
values.append(str(value))


def clean_database(cursor, connection):
command = "DROP TABLE "
command += table_name
command += ";"
command = f"DROP TABLE {table_name} ;"

logging.debug(command)
cursor.execute(command)
Expand All @@ -197,7 +189,7 @@ def check_tables(cursor, connection) :
return tables

def create_database(cursor, connection):
command = "CREATE TABLE " + table_name + " ("
command = f"CREATE TABLE {table_name} ("
command += '''
session TEXT,
issue_name TEXT,
Expand Down