Skip to content

Unary operators does not escape non-Expression

This can be used to inject SQL.

For example:

>>> str(And([Literal(True), 'foo']))
'(%s AND foo)'

should be

>>> str(And([Literal(True), 'foo']))
'(%s AND %s)'
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information