squash migrations - #520
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
029a580 to
a4f6a58
Compare
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
| existing_type = session.execute( | ||
| f"SELECT 1 FROM pg_catalog.pg_type WHERE typname = '{type_name}'", | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| existing_table = session.execute( | ||
| f"SELECT to_regclass('public.{table_name}')", None | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
|
|
||
| def downgrade(self, session): | ||
| for view in VIEWS: | ||
| session.execute(f"DROP VIEW IF EXISTS public.{view} CASCADE", None) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| DELETE FROM iam_permissions | ||
| WHERE uuid = '{_u(name)}'; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_permissions (uuid, name, description) | ||
| VALUES ('{_u(name)}', '{name}', '{description}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_binding_permissions (uuid, role, permission, project_id) | ||
| VALUES ('{_u("binding." + name)}', '{OWNER_ROLE_UUID}', | ||
| '{_u(name)}', '{COMPUTE_PROJECT_UUID}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_binding_permissions WHERE permission = '{_u(name)}'", | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_permissions WHERE uuid = '{_u(name)}'", None | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| INSERT INTO iam_binding_permissions ( | ||
| uuid, role, permission, project_id | ||
| ) VALUES ( | ||
| '{_u("binding." + name)}', | ||
| '{OWNER_ROLE_UUID}', | ||
| '{_u(name)}', | ||
| '{COMPUTE_PROJECT_UUID}' | ||
| ) ON CONFLICT (uuid) DO NOTHING; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| DELETE FROM iam_binding_permissions | ||
| WHERE permission = '{_u(name)}'; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| DELETE FROM iam_permissions | ||
| WHERE uuid = '{_u(name)}'; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| INSERT INTO iam_permissions ( | ||
| uuid, name, description | ||
| ) VALUES ( | ||
| '{_u(name)}', | ||
| '{name}', | ||
| '{description}' | ||
| ) ON CONFLICT (uuid) DO NOTHING; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| INSERT INTO iam_binding_permissions ( | ||
| uuid, role, permission, project_id | ||
| ) VALUES ( | ||
| '{_u("binding." + name)}', | ||
| '{OWNER_ROLE_UUID}', | ||
| '{_u(name)}', | ||
| '{COMPUTE_PROJECT_UUID}' | ||
| ) ON CONFLICT (uuid) DO NOTHING; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute(f""" | ||
| DELETE FROM iam_permissions | ||
| WHERE uuid = '{_u(name)}'; | ||
| """) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_permissions (uuid, name, description) | ||
| VALUES ('{_u(name)}', '{name}', '{description}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_binding_permissions (uuid, role, permission, project_id) | ||
| VALUES ('{_u("binding." + name)}', '{OWNER_ROLE_UUID}', | ||
| '{_u(name)}', '{COMPUTE_PROJECT_UUID}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_binding_permissions WHERE permission = '{_u(name)}'", | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_permissions WHERE uuid = '{_u(name)}'", None | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_permissions (uuid, name, description) | ||
| VALUES ('{_u(name)}', '{name}', '{description}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f""" | ||
| INSERT INTO iam_binding_permissions (uuid, role, permission, project_id) | ||
| VALUES ('{_u("binding." + name)}', '{OWNER_ROLE_UUID}', | ||
| '{_u(name)}', '{COMPUTE_PROJECT_UUID}') | ||
| ON CONFLICT (uuid) DO NOTHING; | ||
| """, | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_binding_permissions WHERE permission = '{_u(name)}'", | ||
| None, | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
| session.execute( | ||
| f"DELETE FROM iam_permissions WHERE uuid = '{_u(name)}'", None | ||
| ) |
There was a problem hiding this comment.
security (python.sqlalchemy.security.sqlalchemy-execute-raw-query): Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
Source: opengrep
3 participants
No description provided.