[5.1.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.

Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

1 files changed, 4 insertions, 0 deletions

diff --git a/django/db/models/query_utils.py b/django/db/models/query_utils.py
index 1bf396723e..3584eea7e6 100644
--- a/django/db/models/query_utils.py
+++ b/django/db/models/query_utils.py
@@ -47,8 +47,12 @@ class Q(tree.Node):
     XOR = "XOR"
     default = AND
     conditional = True
+    connectors = (None, AND, OR, XOR)
 
     def __init__(self, *args, _connector=None, _negated=False, **kwargs):
+        if _connector not in self.connectors:
+            connector_reprs = ", ".join(f"{conn!r}" for conn in self.connectors[1:])
+            raise ValueError(f"_connector must be one of {connector_reprs}, or None.")
         super().__init__(
             children=[*args, *sorted(kwargs.items())],
             connector=_connector,