Skip to content

chore(spanner-django): add WHERE 1=1 to unqualified DELETE and UPDATE - #19033

Merged
olavloite merged 1 commit into
mainfrom
spanner-django-where-1is1
Nov 10, 2026
Merged

olavloite merged 1 commit into
mainfrom
spanner-django-where-1is1

Conversation

@olavloite

@olavloite olavloite commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Cloud Spanner requires a WHERE clause for all DELETE and UPDATE statements to prevent accidental table-wide data modifications.

Previously, unqualified queries and schema migration backfills relied on the low-level DB-API driver to rewrite SQL strings and append "WHERE 1=1". The Django backend now generates this clause directly during query compilation and migration execution.

Ensuring that Django generates compliant SQL on its own allows us to safely remove automatic SQL string rewriting from the DB-API driver in a future release without breaking Django applications.

BEGIN_COMMIT_OVERRIDE
fix(spanner-django): add WHERE 1=1 to unqualified DELETE and UPDATE
END_COMMIT_OVERRIDE

Cloud Spanner requires a WHERE clause for all DELETE and UPDATE statements
to prevent accidental table-wide data modifications.

Previously, unqualified queries and schema migration backfills relied on
the low-level DB-API driver to rewrite SQL strings and append "WHERE 1=1".
The Django backend now generates this clause directly during query
compilation and migration execution.

Ensuring that Django generates compliant SQL on its own allows us to
safely remove automatic SQL string rewriting from the DB-API driver in a
future release without breaking Django applications.
@olavloite
olavloite requested a review from a team as a code owner November 10, 2026 09:40

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request ensures that unqualified UPDATE and DELETE statements automatically append a dummy WHERE 1=1 clause in the Django Spanner backend. This is achieved by overriding the as_sql method in SQLDeleteCompiler and SQLUpdateCompiler, updating the schema editor's add_field method, and refining the add_dummy_where utility to handle edge cases safely. Extensive unit and mock server tests have been added to validate this behavior. The reviewer suggested using SQLGlotIR to safely wrap and modify SQL queries instead of manually parsing and manipulating the SQL string to avoid potential parsing issues.

@olavloite
olavloite merged commit 8449bc1 into main Nov 10, 2026
85 checks passed
@olavloite
olavloite deleted the spanner-django-where-1is1 branch November 10, 2026 15:24
@parthea parthea added the release-please:force-run To run release-please label Nov 12, 2026
@release-please release-please Bot removed the release-please:force-run To run release-please label Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants