-
Notifications
You must be signed in to change notification settings - Fork 143
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sqlalchemy query #34
Sqlalchemy query #34
Conversation
Thank you for the contribution and we will get our security team review it as soon as possible. At the meantime could you explain a little bit of why |
I just updated the unit test to better/correctly show why this is valid. The str(arg) only returns a paramaratized query. and will not contain data values.. so session.query(User).filter(User.password=="mypassword!").first() produces SELECT users.id AS users_id, users.name AS users_name, users.fullname AS users_fullname, users.password AS users_password |
Thanks for the explanation. |
Hi, we are in the process of doing security review for this PR. I have one question regarding the SQL expression capture. I read through http://docs.sqlalchemy.org/en/latest/orm/tutorial.html#querying but it doesn't mention SQLAlchemy intentionally separate the SQL expression and user specified parameters into two args under the hood. The unit test covered the Some extra unit test for other operations or official docs mentioning about how SQL expression is generated would be great. |
http://docs.sqlalchemy.org/en/latest/faq/sqlexpressions.html According to the official doc, it seems like it's safe to Thanks! |
@shouichi Thank you for point out the official SQLAlchemy doc. I believe this is enough and I will merge it in once all conflicts are resolved. |
Manually merged due to some conflicts in GA release. |
Add SQL Query to X-Ray Metadata for SQLAlchemy and Flask-SQLAlchemy