mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

Browse Source 
Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f.

Backport of 41b43c74bd from main.
This commit is contained in:
Mariusz Felisiak
2025-09-10 09:53:52 +02:00
committed by Jacob Walls
parent ee0610673b
commit 4ceaaee7e0
8 changed files with 64 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/aggregation/tests.py
View File

@@ -2244,8 +2244,8 @@ class AggregateTestCase(TestCase):
def test_alias_sql_injection(self):
crafted_alias = """injected_name" from "aggregation_author"; --"""
msg = (
"Column aliases cannot contain whitespace characters, quotation marks, "
"semicolons, or SQL comments."
"Column aliases cannot contain whitespace characters, hashes, quotation "
"marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Author.objects.aggregate(**{crafted_alias: Avg("age")})