diff options
| author | Simon Charette <charette.s@gmail.com> | 2019-12-31 12:46:06 -0500 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2020-01-26 18:51:25 +0100 |
| commit | c67a368c16e4680b324b4f385398d638db4d8147 (patch) | |
| tree | 3898d0ce4b7b3010bf893023f9c1320db5ec90f2 /tests | |
| parent | 96d644312106337d714790cbedfcb227f0faa609 (diff) | |
[2.2.x] Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/postgres_tests/test_aggregates.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tests/postgres_tests/test_aggregates.py b/tests/postgres_tests/test_aggregates.py index 6009a95ec0..21dbd862dd 100644 --- a/tests/postgres_tests/test_aggregates.py +++ b/tests/postgres_tests/test_aggregates.py @@ -164,6 +164,10 @@ class TestGeneralAggregate(PostgreSQLTestCase): with self.assertRaises(TypeError): AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field')) + def test_string_agg_delimiter_escaping(self): + values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter="'")) + self.assertEqual(values, {'stringagg': "Foo1'Foo2'Foo4'Foo3"}) + def test_string_agg_charfield(self): values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter=';')) self.assertEqual(values, {'stringagg': 'Foo1;Foo2;Foo4;Foo3'}) |