Upgrading sqlparse 0.3 to 0.4
Breaking0.3.1 → 0.4.4Breaking1Security2Platform1New8Changed3Fixed16Other2
SecurityFixes a ReDOS vulnerability in the parser caused by a regular expression vulnerable to Regular Expression Denial of Service.GHSA-rrm6-wvj7-cwh2 · CVE-2023-30608 ↗
BreakingUpgrade verdict
1 breaking change and a platform requirement change and 2 security fixes.
In plain terms
- Splitting SQL text no longer produces an empty last entry when the input ends with whitespace. Code that dropped the last element of the split result should be updated.
- The package no longer runs on Python 2.7 or 3.4. You need Python 3.5 or newer.
- A crafted SQL input could make the parser hang or consume excessive CPU, so upgrading is recommended.
- A security hole in the code that strips SQL comments could let a crafted input make the parser hang, so upgrading is recommended.
Must act 4 items need code or config changes
Python requirement changed in 0.4.0: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.* → >=3.5.
What you must change
Breaking1
Strings consisting only of whitespace are no longer treated as statements, so sqlparse.split() may no longer return a trailing empty string.
sqlparse.split()Security2
Fixes a ReDOS vulnerability in the parser caused by a regular expression vulnerable to Regular Expression Denial of Service.
Fixes a ReDOS vulnerability in the strip comments filter caused by a vulnerable regular expression.
strip comments filterPlatform1
Removes support for end-of-life Python 2.7 and 3.4; Python 3.5+ is now required.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
function unicode_compatible(cls) - removed:
variable PY2 - removed:
variable PY3 - removed:
variable file_types - removed:
variable string_types - removed:
variable text_type
- changed:
class FilterStack(object) → class FilterStack
- changed:
class StatementSplitter(object) → class StatementSplitter
- changed:
class AlignedIndentFilter(object) → class AlignedIndentFilter
- changed:
class SerializerUnicode(object) → class SerializerUnicode - changed:
class SpacesAroundOperatorsFilter(object) → class SpacesAroundOperatorsFilter - changed:
class StripCommentsFilter(object) → class StripCommentsFilter - changed:
class StripWhitespaceFilter(object) → class StripWhitespaceFilter
- changed:
class OutputFilter(object) → class OutputFilter
- changed:
class ReindentFilter(object) → class ReindentFilter
- changed:
class RightMarginFilter(object) → class RightMarginFilter
- changed:
class TruncateStringFilter(object) → class TruncateStringFilter
- removed:
function is_keyword(value) - removed:
variable FLAGS - added:
variable KEYWORDS_MSACCESS - added:
variable PROCESS_AS_KEYWORD
- changed:
class Lexer(object) → class Lexer - changed:
static method Lexer.get_tokens(text, encoding=…) → method Lexer.get_tokens(text, encoding=…) - added:
method Lexer.add_keywords(keywords) - added:
method Lexer.clear() - added:
method Lexer.default_initialization() - added:
method Lexer.is_keyword(value) - added:
method Lexer.set_SQL_REGEX(SQL_REGEX) - added:
static method Lexer.get_default_instance()
- changed:
class Token(object) → class Token