1
0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00

[5.0.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.

Thanks Eyal (eyalgabay) for the report.
This commit is contained in:
Simon Charette
2024-07-25 18:19:13 +02:00
committed by Sarah Boyce
parent 523da8771b
commit 32ebcbf2e1
5 changed files with 38 additions and 2 deletions

View File

@@ -107,3 +107,10 @@ class UUIDPK(models.Model):
class UUID(models.Model):
uuid = models.UUIDField(null=True)
uuid_fk = models.ForeignKey(UUIDPK, models.CASCADE, null=True)
class JSONFieldModel(models.Model):
data = models.JSONField(null=True)
class Meta:
required_db_features = {"supports_json_field"}