Skip to content

Escape revision messages embedded in triple-quoted docstrings - #1880

Closed
Eryx-Z wants to merge 1 commit into
sqlalchemy:mainfrom
Eryx-Z:fix/escape-revision-docstring-message
Closed

Eryx-Z wants to merge 1 commit into
sqlalchemy:mainfrom
Eryx-Z:fix/escape-revision-docstring-message

Conversation

@Eryx-Z

@Eryx-Z Eryx-Z commented Oct 16, 2026

Copy link
Copy Markdown

Fixes #1879.

generate_revision() passed the revision message straight into script.py.mako, which embeds it in a triple-quoted module docstring. A message containing """ could close that docstring early so the remainder ran as Python when the revision was imported, and backslashes were interpreted as escape sequences so script.doc did not round-trip.

Escape backslashes and triple quotes in _escape_docstring_message() before rendering (covers built-in templates and custom script.py.mako copies).

Test

  • test_create_script_message_with_triple_quotes
  • test_create_script_message_with_backslashes
  • Existing RevisionCommandTest::test_create_script_basic still passes

Unescaped messages containing triple quotes could close the module
docstring early and leave the rest of the message as executable code
when the revision is imported. Backslashes were also interpreted as
escape sequences. Escape both before rendering script.py.mako.
@sqla-tester

Copy link
Copy Markdown
Collaborator

Hi, and thanks for the pull request!

This project accepts pull requests only for issues that a maintainer has already marked with the open for pull requests label. That way we can settle on an approach before anyone spends time writing code.

This pull request references issue #1879, which hasn't been marked open for pull requests, so the change isn't authorized yet and I'm closing it automatically. Once a maintainer adds the label to #1879, reopen this pull request and it will stay open. If #1879 needs more detail before that can happen, a complete runnable example is usually the missing piece, and adding one to the issue is the fastest way to get there.

This is automatic and procedural. It isn't a judgment on your change, and nothing you've written here is lost.

Thanks for your interest in the project!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Revision message is rendered unescaped into the migration docstring; triple quotes and backslashes break the generated script

2 participants