berkmancenter / mediacloud
53%
master: 70%

LAST BUILD BRANCH: release
DEFAULT BRANCH: master
Repo Added
Files 335
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix_db_quote
branch: fix_db_quote
CHANGE BRANCH
x

3353

push

travis-ci

pypt 
In quote(), replace "%" with a shared marker to be further replaced into "%%" when executing

quote() takes on a job of not only escaping database-unsafe strings but
also taking care of strings that could be taken as psycopg2's parameter
placeholders.

However, if quote() were to duplicate "%":

    db.quote("SELECT 'abc%'") == "SELECT 'abc%'"

...result.__execute() would then double the percentage sign again:

    db.query(db.quote("SELECT 'abc%'")) -> "SELECT 'abc%%%%'"

...leading into unexpected results.

Even worse, this could have led to percentage signs followed by 's' to be
taken as psycopg2's parameter placeholders (because result.__execute()
avoids doubling percentage signs on what looks like a psycopg2's parameter
placeholder):

    db.quote("SELECT 'abc %s def'") == "SELECT 'abc %%s def'"
    db.query(db.quote("SELECT 'abc %s def'")) -> "SELECT 'abc %%%s'"

So, quote() would insert a space between '%' and successive 's' in order
to prevent this character sequence to be taken for a psycopg2 parameter
placeholder, which is an error on its own:

    db.quote("SELECT 'abc %s def'") == "SELECT 'abc % s def'"

In this commit, we generate a random marker that is shared between quote()
and result.__execute(). quote() replaces all cases of '%' with this
random marker, and __execute() replaces all cases of the marker into
double percentage sign right before running the query.

    random_marker = <DOUBLE PERCENTAGE SIGN: 0123456789abcdef>
    db.quote("SELECT 'abc %s def'") == "SELECT 'abc <DOUBLE PERCENTAGE SIGN: 0123456789abcdef>s def'"
    db.query(db.quote("SELECT 'abc %s def'")) -> "SELECT 'abc %%s'"

7742 of 14671 relevant lines covered (52.77%)

961.71 hits per line

Relevant lines Covered
14671 RELEVANT LINES 7742 COVERED LINES
961.71 HITS PER LINE
Source Files on fix_db_quote
Coverage ∆ File Lines Relevant Covered Missed Hits/Line

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
3353 fix_db_quote In quote(), replace "%" with a shared marker to be further replaced into "%%" when executing quote() takes on a job of not only escaping database-unsafe strings but also taking care of strings that could be taken as psycopg2's parameter placehold... push pypt travis-ci pending completion  
See All Builds (4335)