Raphael Collet
020ddc3a6b
We introduce a new class of objects to wrap SQL code together with its
parameters. It is designed to be easily composable and to discourage
SQL injections. Its API is similar to the methods of module 'logging':
the code is a format string, and the positional parameters are meant to
be merged into it using the string formatting operator.
# default and increment are parameters of the SQL code in first argument
term = SQL("COALESCE(value, %s) + %s", default, increment)
# term can safely be injected into another SQL, besides regular parameters
query = SQL("SELECT %s FROM mytable WHERE id = %s", term, id_)
The SQL wrapper can return the final SQL code string as query.code, and
the corresponding parameters as query.params (list). The cursor method
execute() can now take an SQL object, and execute it just like
cr.execute(query.code, query.params)
It is quite easy to make SQL objects safe against SQL injections: if the
code is a string literal, then the SQL object is guaranteed safe,
provided the SQL objects within its parameters are themselves safe.
Part-of: odoo/odoo#134677
66 lines
1.8 KiB
Python
66 lines
1.8 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from . import common
|
|
from . import test_acl
|
|
from . import test_api
|
|
from . import test_barcode
|
|
from . import test_base
|
|
from . import test_basecase
|
|
from . import test_cache
|
|
from . import test_deprecation
|
|
from . import test_db_cursor
|
|
from . import test_expression
|
|
from . import test_float
|
|
from . import test_format_address_mixin
|
|
from . import test_func
|
|
from . import test_http_case
|
|
from . import test_image
|
|
from . import test_avatar_mixin
|
|
from . import test_ir_actions
|
|
from . import test_ir_attachment
|
|
from . import test_ir_cron
|
|
from . import test_ir_filters
|
|
from . import test_ir_http
|
|
from . import test_ir_mail_server
|
|
from . import test_ir_model
|
|
from . import test_ir_sequence
|
|
from . import test_ir_sequence_date_range
|
|
from . import test_ir_default
|
|
from . import test_mail
|
|
from . import test_menu
|
|
from . import test_mimetypes
|
|
from . import test_misc
|
|
from . import test_module
|
|
from . import test_orm
|
|
from . import test_ormcache
|
|
from . import test_osv
|
|
from . import test_overrides
|
|
from . import test_qweb_field
|
|
from . import test_qweb
|
|
from . import test_res_config
|
|
from . import test_res_lang
|
|
from . import test_search
|
|
from . import test_split_table
|
|
from . import test_sql
|
|
from . import test_translate
|
|
# from . import test_uninstall # loop
|
|
from . import test_user_has_group
|
|
from . import test_views
|
|
from . import test_xmlrpc
|
|
from . import test_res_company
|
|
from . import test_res_currency
|
|
from . import test_res_partner
|
|
from . import test_res_partner_bank
|
|
from . import test_res_users
|
|
from . import test_reports
|
|
from . import test_test_retry
|
|
from . import test_test_suite
|
|
from . import test_tests_tags
|
|
from . import test_transactions
|
|
from . import test_form_create
|
|
from . import test_cloc
|
|
from . import test_profiler
|
|
from . import test_pdf
|
|
from . import test_neutralize
|
|
from . import test_config_parameter
|