tortoise / tortoise/tortoise-orm

Fuzzy filter function translation to sql not escaping "%" in `LIKE` clause for `update` operations

Open
#1,225 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5.6k
Forks
516
Avg merge
2d 21h
Merged PRs (30d)
9

Description

Describe the bug
Fuzzy filter function translation (like contains, icontains, startswith, istartswith, endswith, iendswith) to raw sql is not escaping % in the LIKE clause for update operations. This leads to error "not enough arguments for format string".

To Reproduce
Down below is a demo to reproduce this bug:

from tortoise import Tortoise, fields, run_async
from tortoise.expressions import Q
from tortoise.models import Model


class Person(Model):
    id = fields.IntField(pk=True)
    id_num = fields.CharField(max_length=18, unique=True, index=True)
    name = fields.CharField(max_length=30, index=True)
    occupation = fields.CharField(max_length=40, index=True)
    alive = fields.BooleanField(index=True, default=True)


async def run():
    await Tortoise.init(db_url="mysql://localhost:3306/", modules={"models": ["__main__"]})

    sql = Person.filter(
        Q(name__startswith="John") &
        Q(id_num__contains="123") &
        Q(occupation__endswith="Doctor")
    ).update(alive=False).sql()
    print(sql)


if __name__ == "__main__":
    run_async(run())

The raw sql string is as below:
'UPDATE `person` SET `alive`=%s WHERE CAST(`name` AS CHAR) LIKE \'John%\' AND CAST(`id_num` AS CHAR) LIKE \'%123%\' AND CAST(`occupation` AS CHAR) LIKE \'%Doctor\''
The printed output of the above code is as below:
UPDATE `person` SET `alive`=%s WHERE CAST(`name` AS CHAR) LIKE 'John%' AND CAST(`id_num` AS CHAR) LIKE '%123%' AND CAST(`occupation` AS CHAR) LIKE '%Doctor'

Tortoise-orm will automatically format the sql with value of alive field, but there are other unescaped % characters.

Expected behavior
The % sign in above fuzzy filter translation in update operations is escaped correctly.

Additional context
None

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the update SQL generation and fuzzy-filter translation used by the MySQL backend; the issue does not name specific files or tests. Run the supplied Person model reproduction and inspect how the generated LIKE patterns are formatted with the update value. Done means the percent signs in contains, startswith, endswith, and related filters are escaped correctly for update SQL.

Written by the indexing model from the issue text.

Assessment

Tech stack
mysql, python
Domain
backend, database
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.