engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORM wave: 24 defects patched across 10 ORMs (157 sites, 62 ecosystems)

Browse source 
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x)
  FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet
MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x)
EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x),
  AddPrincipals HashSet (250x), FK discovery HashSet (6x)
Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x)
SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x)
Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x)
Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x)
TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x),
  updatedColumns Set (100x)
Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x),
  addSubClass (250x), SqlWalker partial (130x)
GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x)
SQLite: SqliteTest unit proof 4/4 PASS (101x)

Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/
  Sequelize/TypeORM/Doctrine/GORM
Whitepaper: 157 sites, 62 ecosystems; PDF 752K
This commit is contained in:
russell@unturf.com 2026-03-27 13:34:26 -04:00
parent db2986ae44
commit d4ed2dff91
49 changed files with 4025 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

24
defects/sqlalchemy/patch/sqlalchemy-0001-values-bindparam-set.patch Normal file
View file

@ -0,0 +1,24 @@
diff --git a/lib/sqlalchemy/sql/compiler.py b/lib/sqlalchemy/sql/compiler.py
--- a/lib/sqlalchemy/sql/compiler.py
+++ b/lib/sqlalchemy/sql/compiler.py
@@ -1392,7 +1392,7 @@ class SQLCompiler(Compiled):
"""
- _values_bindparam: Optional[List[str]] = None
+ _values_bindparam: Optional[Set[str]] = None
_visited_bindparam: Optional[List[str]] = None
@@ -6156,9 +6156,10 @@ class SQLCompiler(Compiled):
if self.positional and visited_bindparam is not None:
counted_bindparam = len(visited_bindparam)
if self._numeric_binds:
+ # CWE-407 fix: store as Set for O(1) membership test in
+ # _process_numeric(). visited_bindparam is still a List for
+ # counting; convert to set when assigning.
if self._values_bindparam is not None:
- self._values_bindparam += visited_bindparam
+ self._values_bindparam.update(visited_bindparam)
else:
- self._values_bindparam = visited_bindparam
+ self._values_bindparam = set(visited_bindparam)