-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rewrite openqa-advanced-retrigger-jobs in python #332
base: master
Are you sure you want to change the base?
Rewrite openqa-advanced-retrigger-jobs in python #332
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Also how about moving scripts to |
An extension would mean that we would need a separate installation tooling and step to install as executable without extension and I would like to avoid that. |
f32c1d5
to
f8d55f9
Compare
Done |
f8d55f9
to
d00d067
Compare
bd97f6e
to
bdd1863
Compare
Updated:
Tested manually with
|
query = ( | ||
f"select id from jobs where ({worker_string}result='{args.result}' " | ||
f"and clone_id is null and t_finished >= '{args.failed_since}'{additional_filters});" | ||
) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Normally I'd say this needs escaping but of course the previous script also didn't have that…
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't know what additional escaping you mean. Why do you mean we need escaping?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think he means something in the lines of https://www.psycopg.org/psycopg3/docs/basic/params.html#execute-arguments
Currently e.g. args.result
could be used to insert arbitrary SQL statements
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While malice is very unlikely (given you'd need access anyway) it could help if people accidentally pass arguments which cause the query to break
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
And one can also (accidentally) break out of the whole psql
invocation.
9725eaf
to
00ab178
Compare
No description provided.