From f47081d273493dda8bac0dcd9dab5c7f48b54ad2 Mon Sep 17 00:00:00 2001 From: qananasikq Date: Thu, 16 Apr 2026 20:44:18 +0300 Subject: [PATCH] escape ilike params in cars route --- encar_scraper/api/routes/cars.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/encar_scraper/api/routes/cars.py b/encar_scraper/api/routes/cars.py index 8b1a8b3..70715c8 100644 --- a/encar_scraper/api/routes/cars.py +++ b/encar_scraper/api/routes/cars.py @@ -28,9 +28,11 @@ def list_cars( query = select(Car) if brand: - query = query.where(Car.brand.ilike(f"%{brand}%")) + escaped_brand = brand.replace("%", r"\%").replace("_", r"\_") + query = query.where(Car.brand.ilike(f"%{escaped_brand}%", escape="\\")) if model: - query = query.where(Car.model.ilike(f"%{model}%")) + escaped_model = model.replace("%", r"\%").replace("_", r"\_") + query = query.where(Car.model.ilike(f"%{escaped_model}%", escape="\\")) if year_min is not None: query = query.where(Car.year >= year_min) if year_max is not None: @@ -62,7 +64,9 @@ def get_car( ): # Детальная информация об автомобиле с изображениями with persistence.session_scope() as session: - car = session.get(Car, car_id) + car = session.execute( + select(Car).options(selectinload(Car.images)).where(Car.id == car_id) + ).scalars().first() if car is None: raise HTTPException(status_code=404, detail="Car not found") return CarRead.model_validate(car).model_dump(mode="json") @@ -76,7 +80,7 @@ def get_car_by_origin( # Поиск автомобиля по origin_id with persistence.session_scope() as session: car = session.execute( - select(Car).where(Car.origin_id == origin_id) + select(Car).options(selectinload(Car.images)).where(Car.origin_id == origin_id) ).scalars().first() if car is None: raise HTTPException(status_code=404, detail="Car not found")