python-sqlparse/CVE-2023-30608.patch
2023-05-04 11:32:02 +08:00

50 lines
1.8 KiB
Diff

From c457abd5f097dd13fb21543381e7cfafe7d31cfb Mon Sep 17 00:00:00 2001
From: Andi Albrecht <albrecht.andi@gmail.com>
Date: Mon, 20 Mar 2023 08:33:46 +0100
Subject: [PATCH] Remove unnecessary parts in regex for bad escaping.
The regex tried to deal with situations where escaping in the
SQL to be parsed was suspicious.
From : https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
---
sqlparse/keywords.py | 4 ++--
tests/test_split.py | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/sqlparse/keywords.py b/sqlparse/keywords.py
index 9c37e50..2017b6c 100644
--- a/sqlparse/keywords.py
+++ b/sqlparse/keywords.py
@@ -67,9 +67,9 @@ SQL_REGEX = {
(r'(?![_A-ZÀ-Ü])-?(\d+(\.\d*)|\.\d+)(?![_A-ZÀ-Ü])',
tokens.Number.Float),
(r'(?![_A-ZÀ-Ü])-?\d+(?![_A-ZÀ-Ü])', tokens.Number.Integer),
- (r"'(''|\\\\|\\'|[^'])*'", tokens.String.Single),
+ (r"'(''|\\'|[^'])*'", tokens.String.Single),
# not a real string literal in ANSI SQL:
- (r'"(""|\\\\|\\"|[^"])*"', tokens.String.Symbol),
+ (r'"(""|\\"|[^"])*"', tokens.String.Symbol),
(r'(""|".*?[^\\]")', tokens.String.Symbol),
# sqlite names can be escaped with [square brackets]. left bracket
# cannot be preceded by word character or a right bracket --
diff --git a/tests/test_split.py b/tests/test_split.py
index a93e3d4..bcc96cf 100644
--- a/tests/test_split.py
+++ b/tests/test_split.py
@@ -20,8 +20,8 @@ def test_split_semicolon():
def test_split_backslash():
- stmts = sqlparse.parse(r"select '\\'; select '\''; select '\\\'';")
- assert len(stmts) == 3
+ stmts = sqlparse.parse("select '\'; select '\'';")
+ assert len(stmts) == 2
@pytest.mark.parametrize('fn', ['function.sql',
--
2.33.0