mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2025-07-19 15:29:08 +02:00
f8df473476
Backport from commit c457abd5f... upstream. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
52 lines
1.9 KiB
Diff
52 lines
1.9 KiB
Diff
From c457abd5f097dd13fb21543381e7cfafe7d31cfb Mon Sep 17 00:00:00 2001
|
|
From: Andi Albrecht <albrecht.andi@gmail.com>
|
|
Date: Mon, 20 Mar 2023 08:33:46 +0100
|
|
Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
|
|
|
|
The regex tried to deal with situations where escaping in the
|
|
SQL to be parsed was suspicious.
|
|
|
|
Upstream-Status: Backport
|
|
CVE: CVE-2023-30608
|
|
|
|
Reference to upstream patch:
|
|
https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
|
|
|
|
[AZ: drop changes to CHANGELOG file and adjust context whitespaces]
|
|
Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
|
|
|
|
Adjust indentation in keywords.py.
|
|
Signed-off-by: Joe Slater <joe.slater@windriver.com>
|
|
---
|
|
sqlparse/keywords.py | 4 ++--
|
|
tests/test_split.py | 4 ++--
|
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
--- sqlparse-0.4.3.orig/sqlparse/keywords.py
|
|
+++ sqlparse-0.4.3/sqlparse/keywords.py
|
|
@@ -72,9 +72,9 @@ SQL_REGEX = {
|
|
(r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
|
|
tokens.Number.Float),
|
|
(r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
|
|
- (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
|
|
+ (r"'(''|\\'|[^'])*'", tokens.String.Single),
|
|
# not a real string literal in ANSI SQL:
|
|
- (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
|
|
+ (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
|
|
(r'(""|".*?[^\\]")', tokens.String.Symbol),
|
|
# sqlite names can be escaped with [square brackets]. left bracket
|
|
# cannot be preceded by word character or a right bracket --
|
|
--- sqlparse-0.4.3.orig/tests/test_split.py
|
|
+++ sqlparse-0.4.3/tests/test_split.py
|
|
@@ -18,8 +18,8 @@ def test_split_semicolon():
|
|
|
|
|
|
def test_split_backslash():
|
|
- stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
|
|
- assert len(stmts) == 3
|
|
+ stmts = sqlparse.parse("select '\'; select '\'';")
|
|
+ assert len(stmts) == 2
|
|
|
|
|
|
@pytest.mark.parametrize('fn', ['function.sql',
|