diff options
| author | Simon Charette <charette.s@gmail.com> | 2025-04-04 10:18:27 -0400 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2025-04-05 20:43:50 +0200 |
| commit | 12b771a1ec4bbfe82405176f5601e6441855a303 (patch) | |
| tree | 1006ad09df611986c0feadba2b5d9747f88b7622 /tests/annotations | |
| parent | 25f97e7bcf2e5064258e07b970b4bdef5fddce51 (diff) | |
Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.
Refs #28900.
Thanks Jeff Iadarola for the report and tests.
Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
Diffstat (limited to 'tests/annotations')
| -rw-r--r-- | tests/annotations/tests.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py index 5df958c333..6c0d7b668c 100644 --- a/tests/annotations/tests.py +++ b/tests/annotations/tests.py @@ -1470,6 +1470,10 @@ class AliasTests(TestCase): with self.assertRaisesMessage(FieldError, msg): getattr(qs, operation)("rating_alias") + def test_alias_after_values(self): + qs = Book.objects.values_list("pk").alias(other_pk=F("pk")) + self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,)) + def test_alias_sql_injection(self): crafted_alias = """injected_name" from "annotations_book"; --""" msg = ( |