🔒 Fix SQL injection in database migration and resolve merge conflicts
This commit safely handles the dynamic table names in database migration queries by leveraging `sqlalchemy.select` and `sqlalchemy.table` in `app/utils/db_migrate.py`. It addresses the `# noqa: S608` exception that was in place for string interpolation SQL queries which are a known security anti-pattern. Additionally, this commit includes the latest updates to `app/views/base.py` from the `main` branch to handle backward compatibility across Starlette versions (<1.0 vs 1.0+) when invoking `Jinja2Templates.TemplateResponse`, resolving previous merge conflicts in the PR. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
@@ -0,0 +1,35 @@
|
||||
import sys
|
||||
from unittest.mock import MagicMock
|
||||
from fastapi.templating import Jinja2Templates
|
||||
|
||||
import os
|
||||
os.makedirs("templates", exist_ok=True)
|
||||
with open("templates/files.html", "w") as f:
|
||||
f.write("Hello")
|
||||
|
||||
templates = Jinja2Templates(directory="templates")
|
||||
original_template_response = templates.TemplateResponse
|
||||
|
||||
def template_response_with_version(*args, **kwargs):
|
||||
print("ARGS:", args)
|
||||
print("KWARGS:", kwargs)
|
||||
if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
|
||||
context = args[1]
|
||||
request = context.get("request")
|
||||
if request is not None:
|
||||
# THIS IS MY FIX
|
||||
print("Running fix logic")
|
||||
return original_template_response(request=request, name=args[0], context=context, **kwargs)
|
||||
|
||||
print("Running original fallback logic", args, kwargs)
|
||||
return original_template_response(*args, **kwargs)
|
||||
|
||||
templates.TemplateResponse = template_response_with_version
|
||||
|
||||
req = MagicMock()
|
||||
try:
|
||||
templates.TemplateResponse("files.html", context={"request": req})
|
||||
print("SUCCESS")
|
||||
except Exception as e:
|
||||
import traceback
|
||||
traceback.print_exc()
|
||||
Reference in New Issue
Block a user