diff options
| author | Simon Charette <charette.s@gmail.com> | 2019-12-31 12:46:06 -0500 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2020-02-03 08:32:54 +0100 |
| commit | 505826b469b16ab36693360da9e11fd13213421b (patch) | |
| tree | 8d56a29f54d26783903dda167a4108d58f72d814 /tests/postgres_tests/test_aggregates.py | |
| parent | 673444da5e721c0d23809076c5d5d74224457d23 (diff) | |
[3.0.x] Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter.
Diffstat (limited to 'tests/postgres_tests/test_aggregates.py')
| -rw-r--r-- | tests/postgres_tests/test_aggregates.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tests/postgres_tests/test_aggregates.py b/tests/postgres_tests/test_aggregates.py index eb07c44595..0ad120e21a 100644 --- a/tests/postgres_tests/test_aggregates.py +++ b/tests/postgres_tests/test_aggregates.py @@ -163,6 +163,10 @@ class TestGeneralAggregate(PostgreSQLTestCase): with self.assertRaises(TypeError): AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field')) + def test_string_agg_delimiter_escaping(self): + values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter="'")) + self.assertEqual(values, {'stringagg': "Foo1'Foo2'Foo4'Foo3"}) + def test_string_agg_charfield(self): values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter=';')) self.assertEqual(values, {'stringagg': 'Foo1;Foo2;Foo4;Foo3'}) |