mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-09-25 07:59:11 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.

Browse Source 
Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
This commit is contained in:
Jake Howard 2025-08-13 14:13:42 +02:00 committed by Sarah Boyce
parent d5860d55eb
commit 31334e6965
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
django/db/models/sql/query.py
View File

@ -1620,6 +1620,7 @@ class Query(BaseExpression):
return target_clause return target_clause
def add_filtered_relation(self, filtered_relation, alias): def add_filtered_relation(self, filtered_relation, alias):
self.check_alias(alias)
filtered_relation.alias = alias filtered_relation.alias = alias
lookups = dict(get_children_from_q(filtered_relation.condition)) lookups = dict(get_children_from_q(filtered_relation.condition))
relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type( relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type(

7
docs/releases/4.2.24.txt
View File

@ -5,3 +5,10 @@ Django 4.2.24 release notes
*September 3, 2025* *September 3, 2025*
Django 4.2.24 fixes a security issue with severity "high" in 4.2.23. Django 4.2.24 fixes a security issue with severity "high" in 4.2.23.
CVE-2025-57833: Potential SQL injection in ``FilteredRelation`` column aliases
==============================================================================
:class:`.FilteredRelation` was subject to SQL injection in column aliases,
using a suitably crafted dictionary, with dictionary expansion, as the
``**kwargs`` passed to :meth:`.QuerySet.annotate` or :meth:`.QuerySet.alias`.

24
tests/annotations/tests.py
View File

@ -12,6 +12,7 @@ from django.db.models import (
Exists, Exists,
ExpressionWrapper, ExpressionWrapper,
F, F,
FilteredRelation,
FloatField, FloatField,
Func, Func,
IntegerField, IntegerField,
@ -1121,6 +1122,15 @@ class NonAggregateAnnotationTestCase(TestCase):
with self.assertRaisesMessage(ValueError, msg): with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(**{crafted_alias: Value(1)}) Book.objects.annotate(**{crafted_alias: Value(1)})
def test_alias_filtered_relation_sql_injection(self):
crafted_alias = """injected_name" from "annotations_book"; --"""
msg = (
"Column aliases cannot contain whitespace characters, quotation marks, "
"semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
def test_alias_forbidden_chars(self): def test_alias_forbidden_chars(self):
tests = [ tests = [
'al"ias', 'al"ias',
@ -1146,6 +1156,11 @@ class NonAggregateAnnotationTestCase(TestCase):
with self.assertRaisesMessage(ValueError, msg): with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(**{crafted_alias: Value(1)}) Book.objects.annotate(**{crafted_alias: Value(1)})
with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(
**{crafted_alias: FilteredRelation("authors")}
)
class AliasTests(TestCase): class AliasTests(TestCase):
@classmethod @classmethod
@ -1418,3 +1433,12 @@ class AliasTests(TestCase):
) )
with self.assertRaisesMessage(ValueError, msg): with self.assertRaisesMessage(ValueError, msg):
Book.objects.alias(**{crafted_alias: Value(1)}) Book.objects.alias(**{crafted_alias: Value(1)})
def test_alias_filtered_relation_sql_injection(self):
crafted_alias = """injected_name" from "annotations_book"; --"""
msg = (
"Column aliases cannot contain whitespace characters, quotation marks, "
"semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.alias(**{crafted_alias: FilteredRelation("authors")})