MEDIUM

GHSA-27jp-wm6q-gp25

sqlparse: formatting list of tuples leads to denial of service

Quick fix

GHSA-27jp-wm6q-gp25 — sqlparse: upgrade to the fixed version with the command below.

pip install --upgrade 'sqlparse>=0.5.4'

Details

### Summary The below gist hangs while attempting to format a long list of tuples.

This was found while [drafting a regression test for Dja ngo 5.2's composite primary key feature](https://code.djangoproject.com/ticket/36416#comment:3), which allows querying composite fields with tuples.

###

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/sqlparse

Introduced in: 0Fixed in: 0.5.4

Fixpip install --upgrade 'sqlparse>=0.5.4'

References

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-27jp-wm6q-gp25[WEB]
https://github.com/andialbrecht/sqlparse/commit/40ed3aa958657fa4a82055927fa9de70ab903360[WEB]
https://github.com/andialbrecht/sqlparse[PACKAGE]
https://github.com/andialbrecht/sqlparse/releases/tag/0.5.4[WEB]