Repository navigation
feat(lint): apply SQL rules to pgdevkit PostgresJsonResponse - #80
Merged
Merged
Conversation
4 tasks done
aersam
marked this pull request as ready for review
October 9, 2026 13:43
aersam
enabled auto-merge (squash)
October 9, 2026 13:43
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Its first argument is run as SQL like .execute()/fetch_all, so f-string / concat / % / .format()
SQL is flagged, and the inline-complexity and positional-param rules apply. The fix advice for it
doesn't recommend t-strings (the class wraps the query as a subquery and rejects them).
CCMT2's legacy PostgresJsonResponse('postgres', sql) shape stays unchecked (first arg is no SQL).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…l advice pgdevkit 0.14.1 accepts t-string queries, so the usual 'change f to t' fix is right for it too. Also: bdt lint --help and the devtools skill name the checked callees; document that aliases, subclasses and CCMT2's legacy shape are matched by name only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the SQL injection lint (
bdt lint/bdt find-injection) to the query argument ofpgdevkit.fastapi.PostgresJsonResponse(bmsuisse/pgdevkit#48, #49), the same way #79 did forfetch_all/fetch_one/fetch_scalar: f-string / concatenation /%/.format()SQL is an error, and the inline-complexity and positional-param rules apply. t-string,load_sql(),psycopg.sqland literal+params calls stay clean.bdt lint --help, the README and the devtools skill now name the checked callees.as PJR), a subclass under another name (class AppJson(PostgresJsonResponse)), and CCMT2's own legacyPostgresJsonResponse("postgres", sql, ...)(first argument is a connection source, not SQL; skipped silently, never a false positive). Moving CCMT2 to pgdevkit's class brings those call sites under the lint.Test plan
tests/test_lint_sql.py: f-string / concat /%/.format()flagged, bare-name, attribute (pgf.PostgresJsonResponse) andquery=call shapes, variable followed to its unsafe assignment, safe forms clean (incl. t-string), complexity + positional rules, legacy CCMT2 shape not flagged (mutation-checked: 4 of the new tests fail without the registration)PostgresJsonResponsecall (no new false positives)bdt lintandbdt find-injectionend to end on a throwaway project🤖 Generated with Claude Code