Project

General

Profile

« Previous | Next » 

Revision 3578

Added by Aaron Marcuse-Kubitza over 12 years ago

csv2db: COPY FROM: Fixed %-injection bug where column names' %s were not escaped prior to cursor.mogrify(), by changing the code to use inline db.esc_value() instead

View differences:

csv2db
93 93 
        def load_():
94 94 
            # Create COPY FROM statement
95 95 
            if use_copy_from[0]:
96 
                cur = db.db.cursor()
97 96 
                copy_from = ('COPY '+table.to_str(db)+' ('
98 97 
                    +(', '.join(map(esc_name, col_names)))
99 
                    +') FROM STDIN DELIMITER %(delimiter)s NULL %(null)s')
98 
                    +') FROM STDIN DELIMITER '+db.esc_value(dialect.delimiter)
99 
                    +' NULL '+db.esc_value(''))
100 100 
                assert not csvs.is_tsv(dialect)
101 101 
                copy_from += ' CSV'
102 102 
                if dialect.quoting != csv.QUOTE_NONE:
103 
                    copy_from += ' QUOTE %(quotechar)s'
104 
                    if dialect.doublequote: copy_from += ' ESCAPE %(quotechar)s'
103 
                    quote_str = db.esc_value(dialect.quotechar)
104 
                    copy_from += ' QUOTE '+quote_str
105 
                    if dialect.doublequote: copy_from += ' ESCAPE '+quote_str
105 106 
                copy_from += ';\n'
106 
                copy_from = cur.mogrify(copy_from, dict(delimiter=
107 
                    dialect.delimiter, null='', quotechar=dialect.quotechar))
108 107
109 108 
            # Load the data
110 109 
            line_in = streams.ProgressInputStream(in_, sys.stderr, n=1000)

Also available in: Unified diff