remote/sqlite-utils
1
0
Fork 0
mirror of https://github.com/simonw/sqlite-utils.git synced 2026-07-25 18:34:32 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix for db.query("; COMMIT") bypasses the first-token scanner

Browse source 
Refs https://github.com/simonw/sqlite-utils/issues/769#issuecomment-4900034150
This commit is contained in:
Simon Willison 2026-07-06 21:22:29 -07:00
commit adc10df981
4 changed files with 47 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
sqlite_utils/db.py
View file

@ -436,14 +436,15 @@ _QUERY_REJECTED_KEYWORDS = _TRANSACTION_CONTROL_KEYWORDS | {
def _first_keyword(sql: str) -> str:
"""
Return the first keyword of a SQL statement, uppercased, skipping any
leading whitespace and ``--`` or ``/* ... */`` comments - the only
things SQLite's tokenizer allows before the first token. Returns an
empty string if there is no leading keyword.
Return the first keyword of a SQL statement, uppercased, skipping
everything the sqlite3 driver tolerates before the first real token:
whitespace, ``--`` or ``/* ... */`` comments, empty statements
(bare ``;``) and a UTF-8 byte order mark. Returns an empty string if
there is no leading keyword.
"""
i, n = 0, len(sql)
while i < n:
if sql[i].isspace():
if sql[i].isspace() or sql[i] in (";", "\ufeff"):
i += 1
elif sql.startswith("--", i):
newline = sql.find("\n", i)