The Python type generator interpolates enum labels and column names into the generated source without escaping.
Enum Literal[...] values:
|
const variants = this.variants.map((item) => `"${item}"`).join(', ') |
const variants = this.variants.map((item) => `"${item}"`).join(', ')
Field(alias=...):
|
return ` ${this.name}: ${py_type} = Field(alias="${this.pg_name}")` |
return ` ${this.name}: ${py_type} = Field(alias="${this.pg_name}")`
A name that contains a double quote, backslash, or newline produces invalid Python and can inject text into the generated module. The TypeScript template already passes every identifier through JSON.stringify, so the same input is handled there.
I'll send a PR that wraps these with JSON.stringify (which produces a valid Python string literal) and adds a test, matching the TypeScript template.
The Python type generator interpolates enum labels and column names into the generated source without escaping.
Enum
Literal[...]values:postgres-meta/src/server/templates/python.ts
Line 196 in f21a4da
Field(alias=...):postgres-meta/src/server/templates/python.ts
Line 240 in f21a4da
A name that contains a double quote, backslash, or newline produces invalid Python and can inject text into the generated module. The TypeScript template already passes every identifier through
JSON.stringify, so the same input is handled there.I'll send a PR that wraps these with
JSON.stringify(which produces a valid Python string literal) and adds a test, matching the TypeScript template.