Unary operators does not escape non-Expression
This can be used to inject SQL.
For example:
>>> str(And([Literal(True), 'foo']))
'(%s AND foo)'
should be
>>> str(And([Literal(True), 'foo']))
'(%s AND %s)'
All legacy (hg-git based) Projects have been automatically migrated to native with the upgrade of 2025-01-23
This can be used to inject SQL.
For example:
>>> str(And([Literal(True), 'foo']))
'(%s AND foo)'
should be
>>> str(And([Literal(True), 'foo']))
'(%s AND %s)'