coverwallet / pysoni Goto Github PK
View Code? Open in Web Editor NEWClasses to provided extended functionalities to PostgreSQL databases.
License: MIT License
Classes to provided extended functionalities to PostgreSQL databases.
License: MIT License
In most of our code, we are formatting variables into strings by using .format()
or f-strings
. However this is a absolutely discouraged option given that these strings are going to be used as database queries, because they are vulnerable to SQL injection attacks.
Currently this shouldn't be a problem because these library is executed in environments completely controlled by us, that don't get any input from external sources. However, we should get this fixed to prevent huge problems in the future.
The appropriate way to format the strings should be doing it directly on the execute
method, because psycopg2
and asyncpg
handle the formatting while avoiding SQL injection attacks. (See: http://initd.org/psycopg/docs/usage.html#query-parameters).
Currently, we don't connect to the DB until a method needs to do an operation with it. As a consequence, if the DB credentials are incorrect we won't realize until that moment.
In order to prevent exceptions directly on the method, we could do this check in the __init__
method, as soon as we specify the DB credentials. With this approach, we will detect these errors as soon as they are generated.
On #58 we added the possibility of having persistent connections, i.e. connections that can be used several times therefore avoiding the high cost of connecting to the DB each time than an operation is executed. However, it wasn't taken into consideration that, even if the connection is kept open, we need to close the used cursor to prevent blocking the DB. Currently the code that is on the production version of Pysoni contains this problem, so it can create problems in production applications that use persistent connections
The easiest fix will be to always close the DB cursor and use the .is_persistent
field to decide if we should close the connection or not
Command:
pipenv install -e git+ssh://[email protected]/coverwallet/[email protected]#egg=pysoni
Output:
[pipenv.exceptions.InstallError]: File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/cli/command.py", line 254, in install
[pipenv.exceptions.InstallError]: editable_packages=state.installstate.editables,
[pipenv.exceptions.InstallError]: File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 1992, in do_install
[pipenv.exceptions.InstallError]: skip_lock=skip_lock,
[pipenv.exceptions.InstallError]: File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 1253, in do_init
[pipenv.exceptions.InstallError]: pypi_mirror=pypi_mirror,
[pipenv.exceptions.InstallError]: File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 862, in do_install_dependencies
[pipenv.exceptions.InstallError]: _cleanup_procs(procs, False, failed_deps_queue, retry=False)
[pipenv.exceptions.InstallError]: File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 681, in _cleanup_procs
[pipenv.exceptions.InstallError]: raise exceptions.InstallError(c.dep.name, extra=err_lines)
[pipenv.exceptions.InstallError]: ['Collecting psycopg2==2.8.2 (from -r /tmp/pipenv-hyiro314-requirements/pipenv-hao_2nig-requirement.txt (line 1))', ' Using cached https://files.pythonhosted.org/packages/23/7e/93c325482c328619870b6cd09370f6dbe1148283daca65115cd63642e60f/psycopg2-2.8.2.tar.gz']
[pipenv.exceptions.InstallError]: ['ERROR: Complete output from command python setup.py egg_info:', ' ERROR: running egg_info', ' creating pip-egg-info/psycopg2.egg-info', ' writing pip-egg-info/psycopg2.egg-info/PKG-INFO', ' writing dependency_links to pip-egg-info/psycopg2.egg-info/dependency_links.txt', ' writing top-level names to pip-egg-info/psycopg2.egg-info/top_level.txt', " writing manifest file 'pip-egg-info/psycopg2.egg-info/SOURCES.txt'", ' ', ' Error: pg_config executable not found.', ' ', ' pg_config is required to build psycopg2 from source. Please add the directory', ' containing pg_config to the $PATH or specify the full executable path with the', ' option:', ' ', ' python setup.py build_ext --pg-config /path/to/pg_config build ...', ' ', " or with the pg_config option in 'setup.cfg'.", ' ', ' If you prefer to avoid building psycopg2 from source, please install the PyPI', " 'psycopg2-binary' package instead.", ' ', " For further information please check the 'doc/src/install.rst' file (also at", ' <http://initd.org/psycopg/docs/install.html>).', ' ', ' ----------------------------------------', 'ERROR: Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-install-9elhw8f8/psycopg2/']
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.