在 Python influxdb_client 的通量查询中使用参数
Using params in flux queries with Python influxdb_client
我正在尝试更新我们所有的 influxdb python 查询,这样它们就不会受到 sql 注入的攻击。
为此,我了解到您可以将参数与 query_api()
一起使用,特别是与 query_data_frame()
(https://medium.com/sekoia-io-blog/avoiding-injections-with-influxdb-bind-parameters-50f67e379abb)
一起使用
我 运行 遇到的问题是我不知道如何让我的参数传递到我的查询中。以下是我们的一个查询示例:
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"ver": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == ver)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
运行 以上给了我一个 HTTP response body: b'{"error":"type error 5:75-5:78: undefined identifier \"ver\""}\n'
错误。
有谁知道如何使用 Python 将参数正确地注入到通量查询中?
我还使用了以下帮助:
https://influxdb-client.readthedocs.io/_/downloads/en/stable/pdf/
根据用户 16442705 的问题更新
我在我的字典中尝试了另一个变量名,它产生了相同的结果。我还尝试在产生不同错误的查询中使用 $。请参阅以下错误代码:
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"pVersion": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == pVersion)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
HTTP response body: b'{"error":"type error 5:67-5:80: undefined identifier \"pVersion\""}\n'
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"pVersion": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == $pVersion)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
HTTP response body: b'{"error":"loc 0:0-0:0: expected an operator between two expressions"}\n'
另一个需要注意的数据点是我们使用的是以下版本:
- Influxdb-版本:1.8.6
- influxdb-客户端:1.19.0
尝试在查询字符串中使用 $ver
,而不是 ver
。
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"ver": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == $ver) # <---------------------------------
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
问题实际上出在我使用的 influxdb 版本 (1.8.6) 上。查询参数不是 Influxdb 1.8.6 的特性,仅在 Influxdb 2 中引入。0.x
有关 Influxdb-python-client 团队提出的问题,请参阅下面的 link。
https://github.com/influxdata/influxdb-client-python/issues/285
我正在尝试更新我们所有的 influxdb python 查询,这样它们就不会受到 sql 注入的攻击。
为此,我了解到您可以将参数与 query_api()
一起使用,特别是与 query_data_frame()
(https://medium.com/sekoia-io-blog/avoiding-injections-with-influxdb-bind-parameters-50f67e379abb)
我 运行 遇到的问题是我不知道如何让我的参数传递到我的查询中。以下是我们的一个查询示例:
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"ver": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == ver)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
运行 以上给了我一个 HTTP response body: b'{"error":"type error 5:75-5:78: undefined identifier \"ver\""}\n'
错误。
有谁知道如何使用 Python 将参数正确地注入到通量查询中?
我还使用了以下帮助: https://influxdb-client.readthedocs.io/_/downloads/en/stable/pdf/
根据用户 16442705 的问题更新
我在我的字典中尝试了另一个变量名,它产生了相同的结果。我还尝试在产生不同错误的查询中使用 $。请参阅以下错误代码:
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"pVersion": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == pVersion)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
HTTP response body: b'{"error":"type error 5:67-5:80: undefined identifier \"pVersion\""}\n'
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"pVersion": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == $pVersion)
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
HTTP response body: b'{"error":"loc 0:0-0:0: expected an operator between two expressions"}\n'
另一个需要注意的数据点是我们使用的是以下版本:
- Influxdb-版本:1.8.6
- influxdb-客户端:1.19.0
尝试在查询字符串中使用 $ver
,而不是 ver
。
client = InfluxDBClient(url="localhost:5000", token="", timeout=100000, retries=0, enable_gzip=True, profilers="query, operator")
query_api = client.query_api()
ver = "data" # This variable would actually come from a function
params = {
"ver": ver,
}
query = '''from(bucket: "db")
|> range(start: -200d)
|> pivot(rowKey:["_time"], columnKey: ["_field"], valueColumn: "_value")
|> filter(fn: (r) => r._measurement == "test_result")
|> filter(fn: (r) => r.version == $ver) # <---------------------------------
|> keep(columns: ["_time", "test", "run", "status_tag", "duration_sec", "version"])'''
df = query_api.query_data_frame(query=query, params=params)
问题实际上出在我使用的 influxdb 版本 (1.8.6) 上。查询参数不是 Influxdb 1.8.6 的特性,仅在 Influxdb 2 中引入。0.x
有关 Influxdb-python-client 团队提出的问题,请参阅下面的 link。 https://github.com/influxdata/influxdb-client-python/issues/285