databases | π | SQL Database library
kandi X-RAY | databases Summary
kandi X-RAY | databases Summary
Databases gives you simple asyncio support for a range of databases. It allows you to make queries using the powerful SQLAlchemy Core expression language, and provides support for PostgreSQL, MySQL, and SQLite. Databases is suitable for integrating against any async Web framework, such as Starlette, Sanic, Responder, Quart, aiohttp, Tornado, or FastAPI.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
- Executes the given query
- Return a new database URL
- Compile a query
- Fetch a value from the query
- Return a connection object
- Connect to the database
- Generate connection arguments
- Fetch a column from the database
- Create the column map for the result columns
- Executes a query
- Compile a query element
- Yield rows asynchronously
- Execute multiple queries
- Fetch value from query
- Get the package version
- Returns the long description of the README md file
- Execute a query
- Execute a query against the database
- Return a list of package names in a given package
- Executes multiple queries
- Fetch a single row
- Fetch a single record
- Executes a single query
- Start the connection
- Start a new connection
- Hide the password
databases Key Features
databases Examples and Code Snippets
{
"text": "Some note",
"completed": False,
}
{**note.dict()}
{**note.dict(), "id": last_record_id}
{
"id": 1,
"text": "Some note",
"completed": False,
}
This was useful in older frameworks designed to have one single thread per request, no more, no less.
Using this, each request would have its own database connection/session, which is the actual final goal.
But FastAPI, using the new async features
.
βββ sql_app
βββ __init__.py
βββ crud.py
βββ database.py
βββ main.py
βββ schemas.py
void queueEmployeeDbTaskDatabaseUnavailableCase() throws Exception {
var ps = new PaymentService(new PaymentDatabase());
var ss = new ShippingService(new ShippingDatabase(), new ItemUnavailableException());
var ms = new MessagingService(n
void employeeDatabaseUnavailableCase() throws Exception {
var ps = new PaymentService(new PaymentDatabase(), new DatabaseUnavailableException(),
new DatabaseUnavailableException(), new DatabaseUnavailableException(),
new DatabaseU
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication()
.dataSource(dataSource)
.usersByUsernameQuery("select email,password,enabled "
Community Discussions
Trending Discussions on databases
QUESTION
I have the error stated above, and here is the copy log
...ANSWER
Answered 2021-Aug-01 at 00:51You need to use the factory trait for the model to have the factory()
method available.
QUESTION
I am developing a Django app (Django v3.2.10, pytest v7.0.1, pytest-django v4.5.2) which uses cursor to perform raw queries to my secondary DB: my_db2, but when running tests, all the queries return empty results, like if they were running on parallel transactions.
My test file:
...ANSWER
Answered 2022-Feb-24 at 05:47@hoefling and @Arkadiusz Εukasiewicz were right, I just needed to add the corresponding DB within the factories:
QUESTION
I am working on a simple web app for learning purposes using Angular for the frontend and Java Spring for the backend. I don't have a particular problem that I want you guys to help me out with, instead I have a question about OAuth2 authentication.
I have registered my Angular SPA in Azure AD (Authorization Code Flow + PKCE), I set up roles and everything is working okay. My question is what do I do when authenticated users ping my backend? My backend has no information about the users.
I thought of a solution to make a web filter, and every time an authenticated user pings any endpoint requiring the user to be authenticated, to check the database if the user exists (through the username), and save him if he does not exist. I'm pretty sure this will work, but I don't think this is the best solution, considering my web filter will have to read from the databases for every single HTTP request that comes in, and write to the database occasionally (if the user logs in for the first time).
I shouldn't be worried about performance issues because I'm building this strictly for learning purposes, but nevertheless I want to do this the right way. I tried googling this in multiple ways, but I guess I'm not using the right keywords to find what I'm looking for. Any opinion or advice would be much appreciated! Thanks!
EDIT: I followed this article to achieve the OAuth2 + OIDC authentication and authorization, my security config in the backend is the same: https://ordina-jworks.github.io/security/2020/08/18/Securing-Applications-Azure-AD.html
...ANSWER
Answered 2022-Feb-10 at 15:47Post the discussion with clarity on the requirements. If you want to use have the following:
- Accept an Azure AD logged in user to consumer your web service
- You would want to check if the user exists in your application database with minimal network latency.
With the requirement of not always hitting your Database, one option is to use a cache.
The ideal solution for this cache to work is:
- Ensure the cache is checked for every HTTP Request using Web Filter
- Make sure the cache is always updated with the latest users being logged in via Azure AD
Example:
Implement a CacheService.java
QUESTION
I am using MongoDB(Mongo Atlas) in my Django app. All was working fine till yesterday. But today, when I ran the server, it is showing me the following error on console
...ANSWER
Answered 2021-Oct-03 at 05:57This is because of a root CA Letβs Encrypt uses (and Mongo Atals uses Let's Encrypt) has expired on 2020-09-30 - namely the "IdentTrust DST Root CA X3" one.
The fix is to manually install in the Windows certificate store the "ISRG Root X1" and "ISRG Root X2" root certificates, and the "Letβs Encrypt R3" intermediate one - link to their official site - https://letsencrypt.org/certificates/
Copy from the comments: download the .der field from the 1st category, download, double click and follow the wizard to install it.
QUESTION
Well, I have multiple databases in django project. One is default
and second istest_dev
. i have created docker container. and then everything went well till building the container. after that When I try to call my django app api which is using test_dev
db for reading data. I have encountered:
ANSWER
Answered 2022-Jan-03 at 22:02This is an issue with database access privileges. Either the password is wrong, the user was not granted permissions to the specific database or table that you need, or the Django container's IP address does not match the one bound to the user.
The following SQL:
- ensures that the user exists and that login is permitted for that user from any IP address,
- ensures that the user has all privileges on the database
QUESTION
How do I get details of a veracode vulnerability report?
I'm a maintainer of a popular JS library, Ramda, and we've recently received a report that the library is subject to a prototype pollution vulnerability. This has been tracked back to a veracode report that says:
ramda is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the
_curry2
function and modify attributes such as__proto__
,constructor
, andprototype
.
I understand what they're talking about for Prototype Pollution. A good explanation is at snyk's writeup for lodash.merge
. Ramda's design is different, and the obvious analogous Ramda code is not subject to this sort of vulnerability. That does not mean that no part of Ramda is subject to it. But the report contains no details, no code snippet, and no means to challenge their findings.
The details of their description are clearly wrong. _curry2
could not possibly be subject to this problem. But as that function is used as a wrapper to many other functions, it's possible that there is a real vulnerability hidden by the reporter's misunderstanding.
Is there a way to get details of this error report? A snippet of code that demonstrates the problem? Anything? I have filled out their contact form. An answer may still be coming, as it was only 24 hours ago, but I'm not holding my breath -- it seems to be mostly a sales form. All the searching I've done leads to information about how to use their security tool and pretty much nothing about how their custom reports are created. And I can't find this in CVE databases.
...ANSWER
Answered 2022-Jan-07 at 21:46Ok, so to answer my own question, here's how to get the details on a Veracode vulnerability report in less than four weeks and in only fifty-five easy steps.
Pre-workHave someone post an issue against your library suggesting that its
mapObjIndexed
function is subject to the prototype pollution vulnerability.Respond to say that you don't think the user has demonstrated that well-known vulnerability, but that you will dig deeper.
Write a detailed post described what that vulnerability means and demonstrate that the library is not in fact subject to it, or or at least that the example supplied does not demonstrate it.
Carry on a short conversation with interested parties explaining the point more thoroughly and responding to objections.
Leave the issue open for a while so the original reporter can argue the point and respond. 1
Receive a comment on the issue that says that the user has received
a VULN ticket to fix this
Prototype Pollution vulnerability found in ramda.
Carry on a discussion regarding this comment to learn that there is a report that claims that
ramda is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the
_curry2
function and modify attributes such as__proto__
,constructor
, andprototype
.and eventually learn that this is due to a report from the software security company Veracode.
Examine that report to find that it has no details, no explanation of how to trigger the vulnerability, and no suggested fix.
Examine the report and other parts of the Veracode site to find there is no public mechanism to challenge such a report.
Report back to the library's issue that the report must be wrong, as the function mentioned could not possibly generate the behavior described.
Post an actual example of the vulnerability under discussion and a parallel snippet from the library to demonstrate that it doesn't share the problem.
Find Veracode's online support form, and submit a request for help. Keep your expectations low, as this is probably for the sales department.
Post a StackOverflow Question2 asking how to find details of a Veracode vulnerability report, using enough details that if the community has the knowledge, it should be easy to answer.
- Try to enjoy your Friday and Saturday. Don't obsessively check your email to see if Veracode has responded. Don't visit the StackOverflow question every hour to see if anyone has posted a solution. Really, don't do these things; they don't help.
- Add a 250-reputation point bounty to the StackOverflow question, trying to get additional attention from the smart people who must have dealt with this before.
- Find direct email support addresses on the Veracode site, and send an email asking for details of the supposed vulnerability, a snippet that demonstrates the issue, and procedures to challenge their findings.
Receive a response from a Veracode Support email addressthat says, in part,
Are you saying our vuln db is not correct per your github source? If so, I can send it to our research team to ensure it looks good and if not, to update it.
As for snips of code, we do not provide that.
Reply, explaining that you find the report missing the details necessary to challenge it, but that yes, you expect it is incorrect.
Receive a response that this has been "shot up the chain" and that you will be hearing from them soon.
- Again, don't obsessively check your email or the StackOverflow question. But if you do happen to glance at StackOverflow, notice that while there are still no answers to it, there are enough upvotes to cover over half the cost of the bounty. Clearly you're not alone in wanting to know how to do this.
Receive an email from Veracode:
Thank you for your interest in Application Security and Veracode.
Do you have time next week to connect?
Also, to make sure you are aligned with the right rep, where is your company headquartered?
Respond that you're not a potential customer and explain again what you're looking for.
Add a comment to the StackOverflow to explain where the process has gotten to and expressing your frustration.
Watch another weekend go by without any way to address this concern.
Get involved in a somewhat interesting discussion about prototype pollution in the comments to the StackOverflow post.
Receive an actually helpful email from Veracode, sent by someone new, whose signature says he's a sales manager. The email will look like this:
Hi Scott, I asked my team to help out with your question, here was their response:
We have based this artifact from the information available in https://github.com/ramda/ramda/pull/3192. In the Pull Request, there is a POC (https://jsfiddle.net/3pomzw5g/2/) clearly demonstrating the prototype pollution vulnerability in the mapObjIndexed function. In the demo, the user object is modified via the
__proto__β
property and is
considered a violation to the Integrity of the CIA triad. This has been reflected in our CVSS scoring for this vulnerability in our vuln db.There is also an unmerged fix for the vulnerability which has also been
included in our artifact (https://github.com/ramda/ramda/pull/3192/commits/774f767a10f37d1f844168cb7e6412ea6660112d )Please let me know if there is a dispute against the POC, and we can look further into this.
Try to avoid banging your head against the wall for too long when you realize that the issue you thought might have been raised by someone who'd seen the Veracode report was instead the source of that report.
Respond to this helpful person that yes you will have a dispute for this, and ask if you can be put directly in touch with the relevant Veracode people so there doesn't have to be a middleman.
Receive an email from this helpful person -- who needs a name, let's call him "Kevin" -- receive an email from Kevin adding to the email chain the research team. (I told you he was helpful!)
Respond to Kevin and the team with a brief note that you will spend some time to write up a response and get back to them soon.
Look again at the Veracode Report and note that the description has been changed to
ramda is vulnerable to prototype pollution. An attacker is able to inject and modify attributes of an object through the
mapObjIndexed
function via the proto property.but note also that it still contains no details, no snippets, no dispute process.
Receive a bounced-email notification because that research team's email is for internal Veracode use only.
Laugh because the only other option is to cry.
Tell Kevin what happened and make sure he's willing to remain as an intermediary. Again he's helpful and will agree right away.
Spend several hours writing up a detailed response, explaining what prototype pollution is and how the examples do not display this behavior. Post it ahead of time on the issue. (Remember the issue? This is a story about the issue.3) Ask those reading for suggestions before you send the email... mostly as a way to ensure you're not sending this in anger.
Go ahead and email it right away anyway; if you said something too angry you probably don't want to be talked out of it now, anyhow.
Note that the nonrefundable StackOverflow bounty has expired without a single answer being offered.
Twiddle your thumbs for a week, but meanwhile...
Receive a marketing email from Veracode, who has never sent you one before.
Note that Veracode has again updated the description to say
ramda allows object prototype manipulation. An attacker is able to inject and modify attributes of an object through the
mapObjIndexed
function via the proto property. However, due to ramda's design where object immutability is the default, the impact of this vulnerability is limited to the scope of the object instead of the underlying object prototype. Nonetheless, the possibility of object prototype manipulation as demonstrated in the proof-of-concept under References can potentially cause unexpected behaviors in the application. There are currently no known exploits.If that's not clear, a translation would be, "Hey, we reported this, and we don't want to back down, so we're going to say that even though the behavior we noted didn't actually happen, the behavior that's there is still, umm, err, somehow wrong."
Note that a fan of the library whose employer has a Veracode account has been able to glean more information from their reports. It turns out that their details are restricted to logged-in users, leaving it entirely unclear how they thing such vulnerabilities should be fixed.
Send a follow-up email to Kevin4 saying
I'm wondering if there is any response to this.
I see that the vulnerability report has been updated but not removed.
I still dispute the altered version of it. If this behavior is a true vulnerability, could you point me to the equivalent report on JavaScript'sObject.assign
, which, as demonstrated earlier, has the exact same issue as the function in question.My immediate goal is to see this report retracted. But I also want to point out the pain involved in this process, pain that I think Veracode could fix:
I am not a customer, but your customers are coming to me as Ramda's maintainer to fix a problem you've reported. That report really should have enough information in it to allow me to confirm the vulnerability reported. I've learned that such information is available to a logged- in customer. That doesn't help me or others in my position to find the information. Resorting to email and filtering it through your sales department, is a pretty horrible process. Could you alter your public reports to contain or point to a proof of concept of the vulnerability?
And could you further offer in the report some hint at a dispute process?
Receive an email from the still-helpful Kevin, which says
Thanks for the follow up [ ... ], I will continue to manage the communication with my team, at this time they are looking into the matter and it has been raised up to the highest levels.
Please reach back out to me if you donβt have a response within 72 hrs.
Thank you for your patience as we investigate the issue, this is a new process for me as well.
Laugh out loud at the notion that he thinks you're being patient.
Respond, apologizing to Kevin that he's caught in the middle, and read his good-natured reply.
Hear back from Kevin that your main objective has been met:
Hi Scott, I wanted to provide an update, my engineering team got back
to me with the following:βupdating our DB to remove the report is the final outcomeβ
I have also asked for them to let me know about your question regarding the ability to contend findings and will relay that back once feedback is received.
Otherwise, I hope this satisfies your request and please let me know if any further action is needed from us at this time.
Respond gratefully to Kevin and note that you would still like to hear about how they're changing their processes.
Reply to your own email to apologize to Kevin for all the misspelling that happened when you try to type anything more than a short text on your mobile device.
Check with that helpful Ramda user with Veracode log-in abilities whether the site seems to be updated properly.
Reach out to that same user on Twitter when he hasn't responded in five minutes. It's not that you're anxious and want to put this behind you. Really it's not. You're not that kind of person.
Read that user's detailed response explaining that all is well.
Receive a follow-up from the Veracode Support email address telling you that
After much consideration we have decided to update our db to remove this report.
and that they're closing the issue.
Laugh about the fact that they are sending this after what seem likely the close of business for the week (7:00 PM your time on a Friday.)
Respond politely to say that you're grateful for the result, but that you would still like to see their dispute process modernized.
- Write a 2257-word answer5 to your own Stack Overflow question explaining in great detail the process you went through to resolve this issue.
And that's all it takes. So the next time you run into this, you can solve it too!
Update
(because you knew it couldn't be that easy!)
Day 61Receive an email from a new Veracode account executive which says
Thanks for your interest! Introducing myself as your point of contact at Veracode.
I'd welcome the chance to answer any questions you may have around Veracode's services and approach to the space.
Do you have a few minutes free to touch base? Please let me know a convenient time for you and I'll follow up accordingly.
Politely respond to that email suggesting a talk with Kevin and including a link to this list of steps.
1 This is standard behavior with Ramda issues, but it might be the main reason Veracode chose to report this.
2 Be careful not to get into an infinite loop. This recursion does not have a base case.
3 Hey, this was taking place around Thanksgiving. There had to be an Alice's Restaurant reference!
4 If you haven't yet found a Kevin, now would be a good time to insist that Veracode supply you with one.
5 Including footnotes.
QUESTION
I'm build Django app, and it's work fine on my machine, but when I run inside docker container it's rest framework keep crashing, but when I comment any connection with rest framework it's work fine.
- My machine: Kali Linux 2021.3
- docker machine: Raspberry Pi 4 4gb
- docker container image: python:rc-alpine3.14
- python version on my machine: Python 3.9.7
- python version on container: Python 3.10.0rc2
error output:
...ANSWER
Answered 2022-Jan-07 at 19:13You can downgrade your Python version. That should solve your problem; if not, use collections.abc.Mapping
instead of the deprecated collections.Mapping
.
Refer here: Link
QUESTION
So I have a project where I have some predefined rules already set which includes allow database read if user is authenticated and then allow some seperate stuff which i don't know much but when i integrated stripe in my firebase then stripe asked me to add those in my firestore rules.
Now i want to allow everyone to read from one specific collection and its one subcollection but i am not being able to do that
Before my rules were this
...ANSWER
Answered 2021-Dec-29 at 11:16Your rules :
QUESTION
I'm learning Firestore and have built an angular app. I'm using Firebase authentication and having trouble figuring out the rules to use to allow a user access to their data. So for example a products collection which each product has a userId which is actually their email address.
The current rule I have is as follows and is not working (i've tried everything I can figure based on docs, stackoverflow, etc.):
...ANSWER
Answered 2021-Dec-22 at 08:13I think there is some issue with the security rules built. You can refer to the Firestore security rules to learn more about writing rules and for testing your rules you can refer documentation where mentioned :
Cloud Firestore provides a rules simulator that you can use to test your ruleset. You can access the simulator from the Rules tab in the Cloud Firestore section of the Firebase console. The rules simulator lets you simulate authenticated and unauthenticated reads, writes, and deletes.
a) From the screenshot of the Firestore database products collection, the document ID appears to be an auto-generated alphanumeric sequence. So below match rules are going to match document ID (auto-generated) in {userEmail} & {userId} variables instead of the user email or user ID as the variable name suggests.
QUESTION
I installed MSYS2-64bits on my Windows Server 2016 to support some Linux librairies, such as OpenSSL, which I need in my Ruby on Rails development. MSYS2 has been partially installed with Ruby 2.7, but did not complete due to certificates error messages.
I first downloaded and install msys2-x86_64-20210725.exe. It took a very long time and finished after a few messages about Updating the trust database:
...ANSWER
Answered 2021-Dec-17 at 20:02Great question, but it's not exactly the corporate proxy refusing self-signed certificates; it's pacman's SSL agent.
In your browser, go to repo.msys2.org to find which certificates are being used:
Open details:
You'll need to export all certificates individually, but don't need the lowest one for repo.msys2.org:
Save to a local file:
Export using Base-64 encoding:
Can save directly to the trust source anchors folder. Things move around from time to time, but as of now, that's C:\msys64\etc\pki\ca-trust\source\anchors\.cer
Go through the same steps to import the top-level root certificate. Save in the same path, different file name.
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install databases
asyncpg
aiopg
aiomysql
asyncmy
aiosqlite
For this example we'll create a very simple SQLite database to run some queries against. We can now run a simple example from the console. Note that we want to use ipython here, because it supports using await expressions directly from the console. Check out the documentation on making database queries for examples of how to start using databases together with SQLAlchemy core expressions.
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page