13 lines
676 B
Diff
13 lines
676 B
Diff
# UNDF: UNDF-2026-000000298
|
|
diff --git a/lib/sqlalchemy/orm/bulk_persistence.py b/lib/sqlalchemy/orm/bulk_persistence.py
|
|
--- a/lib/sqlalchemy/orm/bulk_persistence.py
|
|
+++ b/lib/sqlalchemy/orm/bulk_persistence.py
|
|
@@ -1870,8 +1870,9 @@ class BulkORMUpdate(BulkUDCompileState, BulkORMSelectAndUpdateMixin):
|
|
else:
|
|
value_evaluators[key] = _evaluator
|
|
|
|
- evaluated_keys = list(value_evaluators.keys())
|
|
+ # CWE-407 fix: use a set for O(1) membership test in to_prefetch
|
|
+ # comprehension and .difference() call below.
|
|
+ evaluated_keys = set(value_evaluators.keys())
|
|
attrib = {k for k, v in resolved_keys_as_propnames}
|