tortoise / tortoise/tortoise-orm
Fuzzy filter function translation to sql not escaping "%" in `LIKE` clause for `update` operations
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5.6k
- Forks
- 516
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 9
Description
Describe the bug
Fuzzy filter function translation (like contains, icontains, startswith, istartswith, endswith, iendswith) to raw sql is not escaping % in the LIKE clause for update operations. This leads to error "not enough arguments for format string".
To Reproduce
Down below is a demo to reproduce this bug:
from tortoise import Tortoise, fields, run_async
from tortoise.expressions import Q
from tortoise.models import Model
class Person(Model):
id = fields.IntField(pk=True)
id_num = fields.CharField(max_length=18, unique=True, index=True)
name = fields.CharField(max_length=30, index=True)
occupation = fields.CharField(max_length=40, index=True)
alive = fields.BooleanField(index=True, default=True)
async def run():
await Tortoise.init(db_url="mysql://localhost:3306/", modules={"models": ["__main__"]})
sql = Person.filter(
Q(name__startswith="John") &
Q(id_num__contains="123") &
Q(occupation__endswith="Doctor")
).update(alive=False).sql()
print(sql)
if __name__ == "__main__":
run_async(run())
The raw sql string is as below:
'UPDATE `person` SET `alive`=%s WHERE CAST(`name` AS CHAR) LIKE \'John%\' AND CAST(`id_num` AS CHAR) LIKE \'%123%\' AND CAST(`occupation` AS CHAR) LIKE \'%Doctor\''
The printed output of the above code is as below:
UPDATE `person` SET `alive`=%s WHERE CAST(`name` AS CHAR) LIKE 'John%' AND CAST(`id_num` AS CHAR) LIKE '%123%' AND CAST(`occupation` AS CHAR) LIKE '%Doctor'
Tortoise-orm will automatically format the sql with value of alive field, but there are other unescaped % characters.
Expected behavior
The % sign in above fuzzy filter translation in update operations is escaped correctly.
Additional context
None
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the update SQL generation and fuzzy-filter translation used by the MySQL backend; the issue does not name specific files or tests. Run the supplied Person model reproduction and inspect how the generated LIKE patterns are formatted with the update value. Done means the percent signs in contains, startswith, endswith, and related filters are escaped correctly for update SQL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mysql, python
- Domain
- backend, database
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100