diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/annotations/tests.py | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py index 6c0d7b668c..060d6324c7 100644 --- a/tests/annotations/tests.py +++ b/tests/annotations/tests.py @@ -14,6 +14,7 @@ from django.db.models import ( Exists, ExpressionWrapper, F, + FilteredRelation, FloatField, Func, IntegerField, @@ -1164,6 +1165,15 @@ class NonAggregateAnnotationTestCase(TestCase): with self.assertRaisesMessage(ValueError, msg): Book.objects.annotate(**{crafted_alias: Value(1)}) + def test_alias_filtered_relation_sql_injection(self): + crafted_alias = """injected_name" from "annotations_book"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Book.objects.annotate(**{crafted_alias: FilteredRelation("author")}) + def test_alias_forbidden_chars(self): tests = [ 'al"ias', @@ -1189,6 +1199,11 @@ class NonAggregateAnnotationTestCase(TestCase): with self.assertRaisesMessage(ValueError, msg): Book.objects.annotate(**{crafted_alias: Value(1)}) + with self.assertRaisesMessage(ValueError, msg): + Book.objects.annotate( + **{crafted_alias: FilteredRelation("authors")} + ) + @skipUnless(connection.vendor == "postgresql", "PostgreSQL tests") @skipUnlessDBFeature("supports_json_field") def test_set_returning_functions(self): @@ -1482,3 +1497,12 @@ class AliasTests(TestCase): ) with self.assertRaisesMessage(ValueError, msg): Book.objects.alias(**{crafted_alias: Value(1)}) + + def test_alias_filtered_relation_sql_injection(self): + crafted_alias = """injected_name" from "annotations_book"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Book.objects.alias(**{crafted_alias: FilteredRelation("authors")}) |