Search code examples
pythonhivejinja2sql-injectionpyhive

How to execute query on hive with jinjasql


Is it possible to execute query for hive using jinjasql and pyhive? When I tried it I got following error.

pyhive.exc.ProgrammingError: Unsupported param format: 
odict_values(['XXXXXXX'])

I can execute query with jinjasql as well as with pyhive but I need to use both together to prevent sql injection.

Environment (all on the same VM.)


Solution

  • Pyhive supports list, tuple and dict in params. While jinjasql supports multiple param style, and as mentioned in the documentation here

    It should return a list, except for 'named' or 'pyformat' which would return a dictionary. Since Jinjasql creates a Ordereddict it is throwing this exception. Solution should be to use a param style which returns a list.

    Hope this helps :)

    UPDATE for python 3: In python 3 you will have to convert the parameters to list as dict.values() returns a view of the dictionary values.