Stubs (.pyi) for type definition for connection and cursor objects #67
Conversation
|
Hi, thank you for submitting this pull request. In order to consider your code we need you to sign the Oracle Contribution Agreement (OCA). Please review the details and follow the instructions at https://oca.opensource.oracle.com/ |
|
My OCA is now approved, you can see my name in the list at https://oca.opensource.oracle.com/?ojr=contrib-list - just go to this page and search for my last name - masiutin |
|
Hi, thank you for your contribution. Please confirm this code is submitted under the terms of the OCA (Oracle's Contribution Agreement) you have previously signed by cutting and pasting the following text as a comment: |
|
I confirm the code being submitted is offered under the terms of the OCA (Oracle's Contribution Agreement) and that I am authorized to contribute it. |
|
I confirm the code being submitted is offered under the terms of the OCA, and that I am authorized to contribute it. |
|
Hi, thank you for your contribution. Your code has been assigned to an internal queue. Please follow |
These .pyi files are needed for static vulnerabilities checkers (e.g. Pyre/Pysa to find SQL injections) or static type checkers.
Please note the following types are defined, like MySQLConnectionAbstract and MySQLCursorAbstract:
def connect(*args: Any, **kwargs: Any) -> MySQLConnectionAbstract: ......
def connect(self, **kwargs: Any) -> MySQLConnectionAbstract: ......
def cursor( self, buffered: Optional[Any] = ..., raw: Optional[Any] = ..., prepared: Optional[Any] = ..., cursor_class: Optional[Any] = ..., dictionary: Optional[Any] = ..., named_tuple: Optional[Any] = ..., ) -> MySQLCursorAbstract: ...Without such definitions, static type checkers cannot infer the types and thus find vulnerabilities.
There was an issue at the "typeshed" library python/typeshed#146 but they didn't integrate the MySQL stubs. They encourage the stubs to be distributed by the developers of the modules. Please also see https://www.python.org/dev/peps/pep-0484/#the-typeshed-repo
With the above stubs, Pyre https://github.com/facebook/pyre-check/ is finally able to find SQL injections in Python code that works with the "mysql.connector".