Skip to content

gh-118928: sqlite3: disallow sequences of params with named placeholders #118929

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erlend-aasland merged 8 commits into from
May 14, 2024
Merged

gh-118928: sqlite3: disallow sequences of params with named placeholders #118929

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b66f04a
gh-118928: sqlite3: disallow sequences of params with named placeholders
erlend-aasland May 10, 2024
6156f7b
Pull in main
erlend-aasland May 11, 2024
1168dd7
Adjust What's New
erlend-aasland May 11, 2024
4481907
Update 3.14.rst
erlend-aasland May 11, 2024
679786c
Update 2024-05-10-22-36-01.gh-issue-118928.IW7Ukv.rst
erlend-aasland May 11, 2024
642015e
Make the diff nicer
erlend-aasland May 14, 2024
62a3eca
Pull in main
erlend-aasland May 14, 2024
f85f318
Pull in changes from PR
erlend-aasland May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
gh-118928: sqlite3: disallow sequences of params with named placeholders 
Follow-up of gh-101693.
  • Loading branch information
@erlend-aasland
erlend-aasland committed May 10, 2024
commit b66f04a0b5d901d5ae38d9dcc083bb62b7b0c094
6 changes: 6 additions & 0 deletions Doc/whatsnew/3.14.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,12 @@ New Modules
Improved Modules
================

sqlite3
-------

Disallow using a sequence of params with named placeholders.
(Contributed by Erlend E. Aasland in :gh:`118928` and :gh:`101693`.)


Optimizations
=============
Expand Down
3 changes: 1 addition & 2 deletions Lib/test/test_sqlite3/test_dbapi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,9 +889,8 @@ def test_execute_named_param_and_sequence(self):
msg = "Binding.*is a named parameter"
for query, params in dataset:
with self.subTest(query=query, params=params):
with self.assertWarnsRegex(DeprecationWarning, msg) as cm:
with self.assertRaisesRegex(sqlite.ProgrammingError, msg) as cm:
self.cu.execute(query, params)
self.assertEqual(cm.filename, __file__)

def test_execute_indexed_nameless_params(self):
# See gh-117995: "'?1' is considered a named placeholder"
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2024-05-10-22-36-01.gh-issue-118928.IW7Ukv.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Disallow using a sequence of params with named placeholders in
Comment thread
erlend-aasland marked this conversation as resolved.
Outdated
:mod:`sqlite3` queries. Patch by Erlend E. Aasland.
9 changes: 2 additions & 7 deletions Modules/_sqlite/cursor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,15 +670,10 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self,
for (i = 0; i < num_params; i++) {
const char *name = sqlite3_bind_parameter_name(self->st, i+1);
if (name != NULL && name[0] != '?') {
int ret = PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
PyErr_Format(state->ProgrammingError,
"Binding %d ('%s') is a named parameter, but you "
"supplied a sequence which requires nameless (qmark) "
"placeholders. Starting with Python 3.14 an "
"sqlite3.ProgrammingError will be raised.",
i+1, name);
if (ret < 0) {
return;
}
"placeholders.", i+1, name);
}

if (PyTuple_CheckExact(parameters)) {
Expand Down