Skip to content

Python type generator does not escape enum labels and column names #1081

Description

@oniani1

The Python type generator interpolates enum labels and column names into the generated source without escaping.

Enum Literal[...] values:

const variants = this.variants.map((item) => `"${item}"`).join(', ')

const variants = this.variants.map((item) => `"${item}"`).join(', ')

Field(alias=...):

return ` ${this.name}: ${py_type} = Field(alias="${this.pg_name}")`

return `    ${this.name}: ${py_type} = Field(alias="${this.pg_name}")`

A name that contains a double quote, backslash, or newline produces invalid Python and can inject text into the generated module. The TypeScript template already passes every identifier through JSON.stringify, so the same input is handled there.

I'll send a PR that wraps these with JSON.stringify (which produces a valid Python string literal) and adds a test, matching the TypeScript template.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions