summaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
Diffstat (limited to 'tests')
-rw-r--r--tests/aggregation/tests.py4
-rw-r--r--tests/annotations/tests.py43
-rw-r--r--tests/expressions/test_queryset_values.py8
-rw-r--r--tests/queries/tests.py4
4 files changed, 30 insertions, 29 deletions
diff --git a/tests/aggregation/tests.py b/tests/aggregation/tests.py
index bd33a532b3..f2ec4bd343 100644
--- a/tests/aggregation/tests.py
+++ b/tests/aggregation/tests.py
@@ -2244,8 +2244,8 @@ class AggregateTestCase(TestCase):
def test_alias_sql_injection(self):
crafted_alias = """injected_name" from "aggregation_author"; --"""
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Author.objects.aggregate(**{crafted_alias: Avg("age")})
diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py
index 8091498908..8e913c8bcf 100644
--- a/tests/annotations/tests.py
+++ b/tests/annotations/tests.py
@@ -1161,12 +1161,12 @@ class NonAggregateAnnotationTestCase(TestCase):
crafted_alias = """injected_name" from "annotations_book"; --"""
# RemovedInDjango70Warning: When the deprecation ends, replace with:
# msg = (
- # "Column aliases cannot contain whitespace characters, quotation "
- # "marks, semicolons, percent signs, or SQL comments."
+ # "Column aliases cannot contain whitespace characters, hashes, "
+ # "quotation marks, semicolons, percent signs, or SQL comments."
# )
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(**{crafted_alias: Value(1)})
@@ -1175,12 +1175,12 @@ class NonAggregateAnnotationTestCase(TestCase):
crafted_alias = """injected_name" from "annotations_book"; --"""
# RemovedInDjango70Warning: When the deprecation ends, replace with:
# msg = (
- # "Column aliases cannot contain whitespace characters, quotation "
- # "marks, semicolons, percent signs, or SQL comments."
+ # "Column aliases cannot contain whitespace characters, hashes, "
+ # "quotation marks, semicolons, percent signs, or SQL comments."
# )
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
@@ -1199,18 +1199,19 @@ class NonAggregateAnnotationTestCase(TestCase):
"alias;",
# RemovedInDjango70Warning: When the deprecation ends, add this:
# "alias%",
- # [] are used by MSSQL.
+ # [] and # are used by MSSQL.
"alias[",
"alias]",
+ "ali#as",
]
# RemovedInDjango70Warning: When the deprecation ends, replace with:
# msg = (
- # "Column aliases cannot contain whitespace characters, quotation "
- # "marks, semicolons, percent signs, or SQL comments."
+ # "Column aliases cannot contain whitespace characters, hashes, "
+ # "quotation marks, semicolons, percent signs, or SQL comments."
# )
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
for crafted_alias in tests:
with self.subTest(crafted_alias):
@@ -1516,12 +1517,12 @@ class AliasTests(TestCase):
crafted_alias = """injected_name" from "annotations_book"; --"""
# RemovedInDjango70Warning: When the deprecation ends, replace with:
# msg = (
- # "Column aliases cannot contain whitespace characters, quotation "
- # "marks, semicolons, percent signs, or SQL comments."
+ # "Column aliases cannot contain whitespace characters, hashes, "
+ # "quotation marks, semicolons, percent signs, or SQL comments."
# )
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.alias(**{crafted_alias: Value(1)})
@@ -1530,12 +1531,12 @@ class AliasTests(TestCase):
crafted_alias = """injected_name" from "annotations_book"; --"""
# RemovedInDjango70Warning: When the deprecation ends, replace with:
# msg = (
- # "Column aliases cannot contain whitespace characters, quotation "
- # "marks, semicolons, percent signs, or SQL comments."
+ # "Column aliases cannot contain whitespace characters, hashes, "
+ # "quotation marks, semicolons, percent signs, or SQL comments."
# )
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Book.objects.alias(**{crafted_alias: FilteredRelation("authors")})
diff --git a/tests/expressions/test_queryset_values.py b/tests/expressions/test_queryset_values.py
index 70e9166655..24f22e8187 100644
--- a/tests/expressions/test_queryset_values.py
+++ b/tests/expressions/test_queryset_values.py
@@ -44,8 +44,8 @@ class ValuesExpressionsTests(TestCase):
def test_values_expression_alias_sql_injection(self):
crafted_alias = """injected_name" from "expressions_company"; --"""
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Company.objects.values(**{crafted_alias: F("ceo__salary")})
@@ -54,8 +54,8 @@ class ValuesExpressionsTests(TestCase):
def test_values_expression_alias_sql_injection_json_field(self):
crafted_alias = """injected_name" from "expressions_company"; --"""
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
JSONFieldModel.objects.values(f"data__{crafted_alias}")
diff --git a/tests/queries/tests.py b/tests/queries/tests.py
index 4158a9a596..4ee4572719 100644
--- a/tests/queries/tests.py
+++ b/tests/queries/tests.py
@@ -1967,8 +1967,8 @@ class Queries5Tests(TestCase):
def test_extra_select_alias_sql_injection(self):
crafted_alias = """injected_name" from "queries_note"; --"""
msg = (
- "Column aliases cannot contain whitespace characters, quotation marks, "
- "semicolons, or SQL comments."
+ "Column aliases cannot contain whitespace characters, hashes, quotation "
+ "marks, semicolons, or SQL comments."
)
with self.assertRaisesMessage(ValueError, msg):
Note.objects.extra(select={crafted_alias: "1"})
generated by cgit v1.3 (git 2.53.0) at 2026-07-10 17:22:02 +0000