vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(query): extend regex for allow backticked aliases

Browse source 
For example:

```
`tabSerial and Batch Entry`.`name` as `child_row`
```

Signed-off-by: Akhil Narang <me@akhilnarang.dev>
This commit is contained in:
Akhil Narang 2025-11-18 23:34:46 +05:30
parent bd84d7a66a
commit 2c15bb4a5b
No known key found for this signature in database
GPG key ID: 9DCC61E211BF645F
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
frappe/database/query.py
View file

@ -59,7 +59,8 @@ def _is_function_call(field_str: str) -> bool:
# - `tabTable-Field`.`field` (hyphens in table name)
# - Any of above with aliases: ... as alias
ALLOWED_FIELD_PATTERN = re.compile(
r"^(?:(`[\w\s-]+`|\w+)\.)?(`[\w\s-]+`|\w+)(?:\s+as\s+\w+)?$", flags=re.ASCII | re.IGNORECASE
r"^(?:(`[\w\s-]+`|\w+)\.)?(`[\w\s-]+`|\w+)(?:\s+as\s+(?:`[\w\s-]+`|\w+))?$",
flags=re.ASCII | re.IGNORECASE,
)
# Regex to parse field names:

3
frappe/tests/test_query.py
View file

@ -153,7 +153,9 @@ class TestQuery(IntegrationTestCase):
"`tabUser`.`name` as alias",
"*",
"`tabHas Role`.`name`",
"field as `alias with space`",
]
invalid_fields = [
"name; DROP TABLE users",
"`name` ; SELECT * FROM secrets",
@ -166,7 +168,6 @@ class TestQuery(IntegrationTestCase):
"field with space",
"`field with space`",
"field as alias with space",
"field as `alias with space`",
"COUNT(*)",
"COUNT(name)",
"SUM(amount) as total",