[int] Tidy up SQL PreparedStatement Parameters in FileManagerPs - #8778
[int] Tidy up SQL PreparedStatement Parameters in FileManagerPs#8778sfayer wants to merge 1 commit into
Conversation
| @staticmethod | ||
| def __validatedIntListToString(values): | ||
| """Helper function to ensure string list arguments are all int-only.""" | ||
| return ",".join(str(int(v)) for v in values) |
There was a problem hiding this comment.
I guess the point of this is that int() will throw an exception if it encounters something it cannot convert? but the exceptions are not caught, as far as I can see.
I guess this is a question for lhcb if they want the exception to propagate or return S_ERROR in the end?
Or am I missing something?
There was a problem hiding this comment.
Yes, that's correct: I think currently in every case the source of the int list is another SQL query that has a column type of int, so it shouldn't ever encounter a non-int. As the field being an int is security critical (because it gets merged into another SQL string directly because we can't parameterise the prepared statement call) this adds an extra defence.
Regards,
Simon
3 participants
Hi,
This is some more SQL fix-up for FileManagerPs: The aim is to manually escape things the classic way for the prepared statements as we can't use parameterised queries with those.
My understanding is that this is only used by LHCb, so shouldn't need a backport, but it'll still need checking very carefully before deployment!
Regards,
Simon
BEGINRELEASENOTES
*DataManagement
FIX: Tidy up SQL PreparedStatement Parameters in FileManagerPs
ENDRELEASENOTES