Ticket #12268: 12268_regex.diff

django/db/models/sql/query.py

@@ -8 +8 @@
 """
 
 import copy
+import re
 
 from django.utils.datastructures import SortedDict
 from django.utils.encoding import force_unicode
@@ -1723 +1724 @@
         self.related_select_cols = []
         self.related_select_fields = []
 
+
+    # This pattern is used to find non-escaped %s patterns in a string.
+    # The idea is to match %s, not %%s, match %%%s and so on. First match
+    # %, then consume double %%, and check if there is still a % left. If
+    # there is, we have even number of % before the s, and thus the s is
+    # not a param, otherwise there is odd number of % and we have a param.
+    params_pattern = re.compile(r'%(%%)*(%)?s', flags=re.MULTILINE)
+
     def add_extra(self, select, select_params, where, params, tables, order_by):
         """
         Adds data to the various extra_* attributes for user-created additions
@@ -1741 +1750 @@
             for name, entry in select.items():
                 entry = force_unicode(entry)
                 entry_params = []
-                pos = entry.find("%s")
-                while pos != -1:
-                    entry_params.append(param_iter.next())
-                    pos = entry.find("%s", pos + 2)
+                # Find all non-escaped %s strings in the entry - see comment
+                # of params_pattern.
+                for group in self.params_pattern.findall(entry):
+                    if not group[1]:
+                        entry_params.append(param_iter.next())
                 select_pairs[name] = (entry, entry_params)
             # This is order preserving, since self.extra_select is a SortedDict.
             self.extra.update(select_pairs)

tests/regressiontests/extra_regress/tests.py

@@ -313 +313 @@
                TestObject.objects.extra(where=["id > %s"], params=[obj.pk]),
             ['<TestObject: TestObject: first,second,third>']
         )
+
+    def test_regression_12268(self):
+        """
+        Test that % escaping works correctly in .extra select. %s needs a
+        select_param, %%s not, %%%s needs a param and so on.
+        """
+        sql = str(TestObject.objects.extra(
+            select={'foo': '%s'}, select_params=['_mark']).query)
+        self.assertTrue('_mark' in sql)
+        sql = str(TestObject.objects.extra(
+            select={'foo': '%%s'}, select_params=['_mark']).query)
+        self.assertTrue('_mark' not in sql)
+        sql = str(TestObject.objects.extra(
+            select={'foo': '%%%s'}, select_params=['_mark']).query)
+        self.assertTrue('_mark' in sql)
+        sql = str(TestObject.objects.extra(
+            select={'foo': '%%%s%%s'}, select_params=['_mark1', '_mark2']).query)
+        self.assertTrue('_mark1' in sql)
+        self.assertTrue('_mark2' not in sql)
+        sql = str(TestObject.objects.extra(
+            select={'foo': 'asdf%%%sasdf%s'}, select_params=['_mark1', '_mark2']).query)
+        self.assertTrue('_mark1' in sql)
+        self.assertTrue('_mark2' in sql)