]> git.ipfire.org Git - thirdparty/sqlalchemy/sqlalchemy.git/commit
audit all types for literal_execute() handling
authorMike Bayer <mike_mp@zzzcomputing.com>
Wed, 22 Jul 2026 15:29:37 +0000 (11:29 -0400)
committerMike Bayer <mike_mp@zzzcomputing.com>
Wed, 22 Jul 2026 17:51:34 +0000 (13:51 -0400)
commit4eba6997dc0f4cd103d47bbc78a5aafaf0c137b1
tree9fd90d866ed9b73a2d79c2fa9768e755b1d4dbb2
parent44ed6bd4b71c2be522cd35623f5502bb263f5f69
audit all types for literal_execute() handling

Added auditing to the test suite which exercises the literal execute
processors across all datatypes and dialects to ensure that string input is
either appropriately rejected or correctly escaped.  Literal execute
processors are invoked when the :paramref:`.bindparam.literal_execute`
parameter is used with an explicit :func:`.bindparam` object, which
overrides DBAPI-native bind handling to render the value inline with the
statement instead. Datatypes that were updated include the originally
reported SQL Server ``Uuid`` / ``UNIQUEIDENTIFIER`` rendering which now
escapes properly, the :class:`.JSONPATH` type that's currently
PostgreSQL-only, and a full family of numeric types stemming from the
:class:`_types.Float` and :class:`_types.Numeric` bases which now coerce
the value to a number, rejecting non-numeric input.  Thanks to Javid Khan
for helping to identify the issue.

Fixes: #13448
Change-Id: Ic1a0643fa08e6ba92a54b6032355ef66f61fdb89
doc/build/changelog/unreleased_20/13448.rst [new file with mode: 0644]
lib/sqlalchemy/dialects/mssql/base.py
lib/sqlalchemy/dialects/postgresql/json.py
lib/sqlalchemy/sql/compiler.py
lib/sqlalchemy/sql/sqltypes.py
test/sql/test_types.py