Support cursor.execute(psycopg2.sql.Composable) #1029
Conversation
andersk
force-pushed
the
execute-psycopg2-composable
branch
3 times, most recently
from
50254f3 to
a4c8ebf
Compare
|
Strictly speaking, should we also account for other backends that might not support |
|
@PIG208 Erring on the side of accepting things that might or might not be accepted at runtime is a fine way for type stubs to account for that (and probably the only way in this case). |
andersk
force-pushed
the
execute-psycopg2-composable
branch
from
a4c8ebf to
1cf8dfc
Compare
|
Updated. |
| @@ -13,6 +27,14 @@ else: | |||
|
|
|||
| logger: Any | |||
|
|
|||
| # Protocol matching psycopg2.sql.Composable, to avoid depending psycopg2 | |||
| class _Composable(Protocol): | |||
There was a problem hiding this comment.
Can we depend on types-psycopg2? What do you think?
Refs #114
There was a problem hiding this comment.
A risk in that approach is that typeshed packages are obsoleted when the corresponding upstream packages add type annotations. In fact, psycopg3 (psycopg on PyPI) already has upstream type annotations, and we’ll want to support its version of Composable, which satisfies the same protocol.
|
Can you please resolve a conflict? I've merged something that broke this file |
In addition to str, PostgreSQL cursors accept the psycopg2.sql.Composable type, which is useful for guarding against SQL injections when building raw queries that can’t be parameterized in the normal way (e.g. interpolating identifiers). In order to avoid reintroducing a dependency on psycopg2, we define a Protocol that matches psycopg2.sql.Composable. Documentation: https://www.psycopg.org/docs/sql.html Related: python/typeshed#7494 Signed-off-by: Anders Kaseorg <andersk@mit.edu>
andersk
force-pushed
the
execute-psycopg2-composable
branch
from
1cf8dfc to
376406c
Compare
|
No problem, resolved. |
In addition to
str, PostgreSQL cursors accept thepsycopg2.sql.Composabletype, which is useful for guarding against SQL injections when building raw queries that can’t be parameterized in the normal way (e.g. interpolating identifiers).In order to avoid reintroducing a dependency on
psycopg2, we define aProtocolthat matchespsycopg2.sql.Composable.Documentation: https://www.psycopg.org/docs/sql.html
Related: python/typeshed#7494