depaul-dice / sciunit

BSD 3-Clause "New" or "Revised" License
1 stars 4 forks source link

Make sqlite query more robust #36

Open charmoniumQ opened 9 months ago

charmoniumQ commented 9 months ago

Sciunit will fail when an argument contains an apostrophe.

For example:

$ sciunit exec sh -c "echo 'hello'"
Traceback (most recent call last):
  File "/nix/store/k708yhw0wpw713hzqxbgz77nciwjl4hr-python3.10-sciunit2-0.4.post82.dev130189670/bin/.sciunit-wrapped", line 9, in <module>
    sys.exit(main())
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/cli.py", line 64, in main
    _main(sys.argv[1:])
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/cli.py", line 101, in _main
    r = cmd.run(args[1:])
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/command/exec_/__init__.py", line 36, in run
    return self.do_commit('cde-package', rev, emgr, repo)
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/command/mixin.py", line 20, in do_commit
    return (repo.location,) + emgr.commit(sz)
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/records.py", line 150, in commit
    raise exc
  File "/nix/store/k3dvzagbrfnddyzdjswxic4qh9byks00-python3-3.10.13-env/lib/python3.10/site-packages/sciunit2/records.py", line 144, in commit
    self.__c.executescript(script)
sqlite3.OperationalError: near "hello": syntax error

The query that sciunit generates looks like this;

insert into revs (data)
values (
    '{"cmd":["sh","-c","echo 'hello'"],"started":"2024-02-08T21:00:16.671802Z","size":229683200}'
);

Since the third line is delimited by apostrophes, and third argument, echo 'hello', contains an apostrophe, it breaks the query.

Instead of this Python sqlite supports using ? as a place-holder for that argument. If we use placeholder, then the statement will be parsed correctly, even if the value of the placeholder has an apostrophe or any other special character.

While this is only strictly necessary for commit, I decided to change the other two (integer valued) queries as well because its better practice to use place-holders.