coverwallet / pysoni Goto Github PK

View Code? Open in Web Editor NEW

4.0 4.0 0.0 290 KB

Classes to provided extended functionalities to PostgreSQL databases.

License: MIT License

Python 99.63% Dockerfile 0.37%

pysoni's People

Contributors

Stargazers

Watchers

pysoni's Issues

Use string formatting methods that prevent SQL injection

Where?

Related PR: #5 (review)

What?

In most of our code, we are formatting variables into strings by using .format() or f-strings. However this is a absolutely discouraged option given that these strings are going to be used as database queries, because they are vulnerable to SQL injection attacks.

Currently this shouldn't be a problem because these library is executed in environments completely controlled by us, that don't get any input from external sources. However, we should get this fixed to prevent huge problems in the future.

How?

The appropriate way to format the strings should be doing it directly on the execute method, because psycopg2 and asyncpg handle the formatting while avoiding SQL injection attacks. (See: http://initd.org/psycopg/docs/usage.html#query-parameters).

Raise exceptions in init method if we can't connect to the DB

What

Currently, we don't connect to the DB until a method needs to do an operation with it. As a consequence, if the DB credentials are incorrect we won't realize until that moment.

How

In order to prevent exceptions directly on the method, we could do this check in the __init__ method, as soon as we specify the DB credentials. With this approach, we will detect these errors as soon as they are generated.

Close cursor on persistent connections

What?

On #58 we added the possibility of having persistent connections, i.e. connections that can be used several times therefore avoiding the high cost of connecting to the DB each time than an operation is executed. However, it wasn't taken into consideration that, even if the connection is kept open, we need to close the used cursor to prevent blocking the DB. Currently the code that is on the production version of Pysoni contains this problem, so it can create problems in production applications that use persistent connections

How?

The easiest fix will be to always close the DB cursor and use the .is_persistent field to decide if we should close the connection or not

Psycopg2 still does causes ImportError when installiing version 0.2.2

Command:

pipenv install -e git+ssh://[email protected]/coverwallet/[email protected]#egg=pysoni

Output:

[pipenv.exceptions.InstallError]:   File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/cli/command.py", line 254, in install
[pipenv.exceptions.InstallError]:       editable_packages=state.installstate.editables,
[pipenv.exceptions.InstallError]:   File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 1992, in do_install
[pipenv.exceptions.InstallError]:       skip_lock=skip_lock,
[pipenv.exceptions.InstallError]:   File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 1253, in do_init
[pipenv.exceptions.InstallError]:       pypi_mirror=pypi_mirror,
[pipenv.exceptions.InstallError]:   File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 862, in do_install_dependencies
[pipenv.exceptions.InstallError]:       _cleanup_procs(procs, False, failed_deps_queue, retry=False)
[pipenv.exceptions.InstallError]:   File "/home/fjlozano/.local/lib/python3.6/site-packages/pipenv/core.py", line 681, in _cleanup_procs
[pipenv.exceptions.InstallError]:       raise exceptions.InstallError(c.dep.name, extra=err_lines)
[pipenv.exceptions.InstallError]: ['Collecting psycopg2==2.8.2 (from -r /tmp/pipenv-hyiro314-requirements/pipenv-hao_2nig-requirement.txt (line 1))', '  Using cached https://files.pythonhosted.org/packages/23/7e/93c325482c328619870b6cd09370f6dbe1148283daca65115cd63642e60f/psycopg2-2.8.2.tar.gz']
[pipenv.exceptions.InstallError]: ['ERROR: Complete output from command python setup.py egg_info:', '    ERROR: running egg_info', '    creating pip-egg-info/psycopg2.egg-info', '    writing pip-egg-info/psycopg2.egg-info/PKG-INFO', '    writing dependency_links to pip-egg-info/psycopg2.egg-info/dependency_links.txt', '    writing top-level names to pip-egg-info/psycopg2.egg-info/top_level.txt', "    writing manifest file 'pip-egg-info/psycopg2.egg-info/SOURCES.txt'", '    ', '    Error: pg_config executable not found.', '    ', '    pg_config is required to build psycopg2 from source.  Please add the directory', '    containing pg_config to the $PATH or specify the full executable path with the', '    option:', '    ', '        python setup.py build_ext --pg-config /path/to/pg_config build ...', '    ', "    or with the pg_config option in 'setup.cfg'.", '    ', '    If you prefer to avoid building psycopg2 from source, please install the PyPI', "    'psycopg2-binary' package instead.", '    ', "    For further information please check the 'doc/src/install.rst' file (also at", '    <http://initd.org/psycopg/docs/install.html>).', '    ', '    ----------------------------------------', 'ERROR: Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-install-9elhw8f8/psycopg2/']

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.