russell@unturf.com
d4ed2dff91
Hibernate (5 HIGH): addColumn/addReferencedColumn/addIndex ArrayList→LinkedHashSet (19x) FK second-pass LinkedHashSet, orderHierarchy LinkedHashSet MyBatis (1 MEDIUM): sortConstructorMappings indexOf→HashMap (12x) EF Core (2 HIGH + 1 MEDIUM): FindGenerationProperty HashSet (250x), AddPrincipals HashSet (250x), FK discovery HashSet (6x) Diesel (3 MEDIUM): SQLite/MySQL row position()→BTreeMap (51x) SQLAlchemy (2 HIGH): _values_bindparam Set (500x), evaluated_keys Set (500x) Peewee (1 MEDIUM): _SortedFieldList.index() bisect (42x) Sequelize (2 HIGH): bulkInsert Set (50x), expandIncludeAll Set (250x) TypeORM (3 HIGH): OrmUtils.uniq Map (500x), diffColumns Set (125x), updatedColumns Set (100x) Doctrine ORM (1 HIGH + 2 MEDIUM): hydrator discriminator (26x), addSubClass (250x), SqlWalker partial (130x) GORM (1 MEDIUM): sortCallbacks getRIndex→map (194x) SQLite: SqliteTest unit proof 4/4 PASS (101x) Unit tests: all PASS — Hibernate/MyBatis/EfCore/Diesel/SQLAlchemy/Peewee/ Sequelize/TypeORM/Doctrine/GORM Whitepaper: 157 sites, 62 ecosystems; PDF 752K
24 lines
1.1 KiB
Diff
24 lines
1.1 KiB
Diff
diff --git a/lib/sqlalchemy/sql/compiler.py b/lib/sqlalchemy/sql/compiler.py
|
|
--- a/lib/sqlalchemy/sql/compiler.py
|
|
+++ b/lib/sqlalchemy/sql/compiler.py
|
|
@@ -1392,7 +1392,7 @@ class SQLCompiler(Compiled):
|
|
|
|
"""
|
|
- _values_bindparam: Optional[List[str]] = None
|
|
+ _values_bindparam: Optional[Set[str]] = None
|
|
|
|
_visited_bindparam: Optional[List[str]] = None
|
|
|
|
@@ -6156,9 +6156,10 @@ class SQLCompiler(Compiled):
|
|
if self.positional and visited_bindparam is not None:
|
|
counted_bindparam = len(visited_bindparam)
|
|
if self._numeric_binds:
|
|
+ # CWE-407 fix: store as Set for O(1) membership test in
|
|
+ # _process_numeric(). visited_bindparam is still a List for
|
|
+ # counting; convert to set when assigning.
|
|
if self._values_bindparam is not None:
|
|
- self._values_bindparam += visited_bindparam
|
|
+ self._values_bindparam.update(visited_bindparam)
|
|
else:
|
|
- self._values_bindparam = visited_bindparam
|
|
+ self._values_bindparam = set(visited_bindparam)
|