)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5652,"name":"David Ripton","email":"dripton@redhat.com","username":"dripton"},"change_message_id":"7e2c5d7f55cbababbe409e113a4116f0e2e55193","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix _drop_unique_constraint_in_sqlite() function."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We got incorrect unique constrains in function"},{"line_number":10,"context_line":"_drop_unique_constraint_in_sqlite()."},{"line_number":11,"context_line":"New function `_get_unique_constraints_in_sqlite()` was added to fix it."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAPX%2F%2Fl74%3D","line":9,"updated":"2013-06-14 19:48:42.000000000","message":"s/constrains/constraints/g","commit_id":"251a4b8453a7a0218badd805d6f805a5c6d78a24"}],"nova/db/sqlalchemy/utils.py":[{"author":{"_account_id":5652,"name":"David Ripton","email":"dripton@redhat.com","username":"dripton"},"change_message_id":"7e2c5d7f55cbababbe409e113a4116f0e2e55193","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    sql_data \u003d migrate_engine.execute("},{"line_number":96,"context_line":"        \"\"\"SELECT sql FROM sqlite_master"},{"line_number":97,"context_line":"        WHERE type \u003d \u0027table\u0027 and name \u003d \u0027{0}\u0027;\"\"\""},{"line_number":98,"context_line":"        .format(table_name)"},{"line_number":99,"context_line":"    ).fetchone()[0]"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    uniques \u003d set(["}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPX%2F%2Fl78%3D","line":98,"updated":"2013-06-14 19:48:42.000000000","message":"This code looks like a candidate for SQL string injection attack.  Table name should be a proper bind parameter not a string substitution.","commit_id":"251a4b8453a7a0218badd805d6f805a5c6d78a24"},{"author":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"change_message_id":"60ece4bec24f4eec36f858102c312e553c8a6add","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    sql_data \u003d migrate_engine.execute("},{"line_number":96,"context_line":"        \"\"\"SELECT sql FROM sqlite_master"},{"line_number":97,"context_line":"        WHERE type \u003d \u0027table\u0027 and name \u003d \u0027{0}\u0027;\"\"\""},{"line_number":98,"context_line":"        .format(table_name)"},{"line_number":99,"context_line":"    ).fetchone()[0]"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    uniques \u003d set(["}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPX%2F%2Fl7s%3D","line":98,"in_reply_to":"AAAAPX%2F%2Fl78%3D","updated":"2013-06-14 19:52:34.000000000","message":"If we make this code accessible to someone calling into the API, then we should have our heads examined :)  As far as I can see, this code is only used to set up unique constraints, which only happens on database migration, which only occurs when an admin executes \"nova-manage db sync\".  Do you see any case in which any of the unique constraints code is called outside a database migration script?","commit_id":"251a4b8453a7a0218badd805d6f805a5c6d78a24"}]}