Merge pull request #3 from pythonutilities/develop

upgrade packages for security (#2)

Author: SridharCR

.github/workflows/workflow.yml

@@ -1,14 +1,14 @@
 name: Tests
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main, develop]
 jobs:
   jinjasql:
     name: JinjaSQL Tests
     runs-on: ubuntu-latest
-    strategy: 
+    strategy:
       matrix:
-        python-version: ["3.5", "3.6", "3.7", "3.8", "3.9", "3.10"]
+        python-version: ["3.8", "3.9", "3.10", "3.11"]
     steps:
       - uses: actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
@@ -21,4 +21,3 @@ jobs:
           pip install -r requirements.txt
       - name: Unit Tests
         run: python run_tests
-      

.gitignore

@@ -5,4 +5,6 @@ build/
 dist/
 jinjasql.egg-info/
 venv
-.idea
+.idea
+pyproject.toml
+poetry.lock

jinjasql/core.py

@@ -1,10 +1,9 @@
 from __future__ import unicode_literals
-from jinja2 import contextfilter
 from jinja2 import Environment
 from jinja2 import Template
 from jinja2.ext import Extension
 from jinja2.lexer import Token
-from jinja2.utils import Markup
+from jinja2.utils import markupsafe
 from collections.abc import Iterable
 
 try:
@@ -96,7 +95,7 @@ def filter_stream(self, stream):
 def sql_safe(value):
     """Filter to mark the value of an expression as safe for inserting
     in a SQL statement"""
-    return Markup(value)
+    return markupsafe.Markup(value)
 
 def identifier(value):
     """A filter that escapes a SQL identifier, usually database objects
@@ -117,7 +116,7 @@ def escape_postgres(tuple_or_str):
     values = (tuple_or_str, ) if not isinstance(tuple_or_str, tuple) else tuple_or_str
     def escape_double_quotes(value):
         return value.replace('"', '""')
-    return Markup('.'.join('"{}"'.format(escape_double_quotes(value)) for value in values))
+    return markupsafe.Markup('.'.join('"{}"'.format(escape_double_quotes(value)) for value in values))
 
 def bind(value, name):
     """A filter that prints %s, and stores the value 
@@ -126,7 +125,7 @@ def bind(value, name):
     This filter is automatically applied to every {{variable}} 
     during the lexing stage, so developers can't forget to bind
     """
-    if isinstance(value, Markup):
+    if isinstance(value, markupsafe.Markup):
         return value
     else:
         return _bind_param(_thread_local.bind_params, name, value)
@@ -175,7 +174,7 @@ def identifier_filter(raw_identifier):
             raw_identifier = (raw_identifier, )
         if not isinstance(raw_identifier, Iterable):
             raise ValueError("identifier filter expects a string or an Iterable")
-        return Markup('.'.join(quote_and_escape(s) for s in raw_identifier))
+        return markupsafe.Markup('.'.join(quote_and_escape(s) for s in raw_identifier))
 
     return identifier_filter
 
@@ -195,12 +194,14 @@ class JinjaSql(object):
     # asyncpg "where name = $1"
     VALID_PARAM_STYLES = ('qmark', 'numeric', 'named', 'format', 'pyformat', 'asyncpg')
     VALID_ID_QUOTE_CHARS = ('`', '"')
-    def __init__(self, env=None, param_style='format', db_engine='postgres', identifier_quote_character='"'):
+    def __init__(self, env=None, param_style='named', db_engine='postgres', identifier_quote_character='"'):
         # self.env = env or Environment()
         # self._prepare_environment()
         self.param_style = param_style
         if identifier_quote_character not in self.VALID_ID_QUOTE_CHARS:
-            raise ValueError("identifier_quote_characters must be one of " + VALID_ID_QUOTE_CHARS)
+            raise ValueError(
+                f"identifier_quote_characters must be one of {JinjaSql.VALID_ID_QUOTE_CHARS}"
+            )
         self.identifier_quote_character = identifier_quote_character
         self.db_engine = db_engine
         self.env = env or Environment()
@@ -209,7 +210,6 @@ def __init__(self, env=None, param_style='format', db_engine='postgres', identif
     def _prepare_environment(self):
         self.env.autoescape = True
         self.env.add_extension(SqlExtension)
-        self.env.add_extension('jinja2.ext.autoescape')
         self.env.filters["bind"] = bind
         self.env.filters["sqlsafe"] = sql_safe
         self.env.filters["inclause"] = bind_in_clause
@@ -234,7 +234,7 @@ def _prepare_query(self, template, data):
             if self.param_style in ('named', 'pyformat'):
                 bind_params = dict(bind_params)
             elif self.param_style in ('qmark', 'numeric', 'format', 'asyncpg'):
-                bind_params = list(bind_params.values())
+                bind_params = tuple(bind_params.values())
             return query, bind_params
         finally:
             del _thread_local.bind_params