Do not use text() as it leads to SQL injection This product is not supported for your selected
Datadog site . (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.
이 규칙을 사용해 보세요 ID: python-flask/disable-sqlalchemy-text
Language: Python
Severity: Warning
Category: Security
CWE : 89
Description The text function from SQLAlchemy lets you build custom SQL statements. It is recommended to use the ORM functions to build queries and avoid building custom queries, which are vulnerable to SQL injections.
Learn More Non-Compliant Code Examples from sqlalchemy.sql import text
con = engine . connect ()
data = ( { "id" : 1 , "title" : "The Hobbit" , "primary_author" : "Tolkien" },
{ "id" : 2 , "title" : "The Silmarillion" , "primary_author" : "Tolkien" },
)
statement = text ( """INSERT INTO book(id, title, primary_author) VALUES(:id, :title, :primary_author)""" )
for line in data :
con . execute ( statement , ** line )
Compliant Code Examples con = engine . connect ()
data = ( { "id" : 1 , "title" : "The Hobbit" , "primary_author" : "Tolkien" },
{ "id" : 2 , "title" : "The Silmarillion" , "primary_author" : "Tolkien" },
)
statement = text ( """INSERT INTO book(id, title, primary_author) VALUES(:id, :title, :primary_author)""" )
for line in data :
con . execute ( statement , ** line )
from sqlalchemy import text
BOOKS = meta . tables [ 'books' ]
query = sqlalchemy . select ( BOOKS ) . where ( BOOKS . c . genre == 'fiction' )
result = engine . execute ( query ) . fetchall ()
원활한 통합. Datadog Code Security를 경험해 보세요
