(value, conn, force_quote=False)
| 309 | |
| 310 | @staticmethod |
| 311 | def qtLiteral(value, conn, force_quote=False): |
| 312 | if not conn: |
| 313 | raise ValueError( |
| 314 | "qtLiteral requires a connection: without one, escaping " |
| 315 | "silently degrades to returning the raw value, which is a " |
| 316 | "SQL injection sink. When using the Jinja filter, ensure " |
| 317 | "render_template is called with conn=<conn>; when calling " |
| 318 | "from Python, pass the connection as the second argument." |
| 319 | ) |
| 320 | |
| 321 | # Resolve the underlying psycopg connection. A wrapped pgAdmin |
| 322 | # Connection has the raw psycopg connection on `.conn`. |
| 323 | if not isinstance(conn, psycopg.Connection) and \ |
| 324 | not isinstance(conn, psycopg.AsyncConnection): |
| 325 | conn = conn.conn |
| 326 | |
| 327 | # psycopg.sql.Literal.as_string can raise for values it cannot |
| 328 | # adapt (custom types without a registered adapter, byte |
| 329 | # sequences in a non-UTF8 client encoding, etc.). The previous |
| 330 | # implementation swallowed the exception and silently returned |
| 331 | # the raw, unescaped `value` — the same SQL-injection sink the |
| 332 | # missing-conn fast-fail above guards against, but on a |
| 333 | # different failure mode. Letting the exception propagate makes |
| 334 | # any unadaptable input loud and callers can react explicitly. |
| 335 | res = psycopg.sql.Literal(value).as_string(conn).strip() |
| 336 | |
| 337 | if force_quote is True: |
| 338 | # Convert the input to the string to use the startsWith(...) |
| 339 | res = str(res) |
| 340 | if not res.startswith("'"): |
| 341 | return "'" + res + "'" |
| 342 | |
| 343 | return res |
| 344 | |
| 345 | @staticmethod |
| 346 | def ScanKeywordExtraLookup(key): |
no outgoing calls