summaryrefslogtreecommitdiff
path: root/tests/queries
AgeCommit message (Collapse)Author
2026-02-03[4.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column ↵Jake Howard
aliases via control characters. Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.
2025-11-05[4.2.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion. Backport of 3c3f46357718166069948625354b8315a8505262 from main.
2025-11-05[4.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-10-01[4.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2023-01-20[4.2.x] Fixed #34267 -- Fixed sliced QuerySet.union() crash.Francesco Panico
Regression in 3d734c09ff0138441dfe0a59010435871d17950f. Thanks Raphaël Stefanini for the report. Backport of cc8aa6bf9c127a493e6dd005012b9e6397b3f319 from main
2022-12-21Removed unnecessary commas in tests.Mariusz Felisiak
2022-12-02Refs #33308 -- Avoided passing None to RawSQL's params.Florian Apolloner
Passing None to params causes errors in determining the data type on psycopg3.
2022-11-23Refs #33050 -- Added test for QuerySet.count() on combined queries with ↵Mariusz Felisiak
select_related(). Thanks Simon Charette for noticing this. Fixed in 70499b25c708557fb9ee2264686cd172f4b2354e.
2022-11-15Fixed #34123 -- Fixed combinator order by alias when using select_related().Simon Charette
Regression in c58a8acd413ccc992dd30afd98ed900897e1f719. Thanks to Shai Berger for the report and tests. Co-Authored-By: David Sanders <shang.xiao.sanders@gmail.com>
2022-11-07Refs #33374 -- Adjusted full match condition handling.Simon Charette
Adjusting WhereNode.as_sql() to raise an exception when encoutering a full match just like with empty matches ensures that all case are explicitly handled.
2022-10-31Fixed #16211 -- Added logical NOT support to F expressions.David Wobrock
2022-10-29Fixed #34125 -- Fixed sliced QuerySet.union() crash on a single non-empty ↵Simon Charette
queryset. The bug existed since sliced query union was added but was elevated to query union slices by moving the .exists() optimization to the compiler in 3d734c09ff0138441dfe0a59010435871d17950f. Thanks Stefan Hammer for the report.
2022-10-08Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to ↵Gregor Gärtner
assertQuerySetEqual(). Co-Authored-By: Michael Howitz <mh@gocept.com>
2022-10-07Replaced assertQuerysetEqual() to assertSequenceEqual()/assertCountEqual() ↵Mariusz Felisiak
where appropriate. Follow up to 3f7b3275627385f8f7531fca01cdda50d4ec6b6e.
2022-10-05Fixed #33768 -- Fixed ordering compound queries by nulls_first/nulls_last on ↵Simon Charette
MySQL. Columns of the left outer most select statement in a combined query can be referenced by alias just like by index. This removes combined query ordering by column index and avoids an unnecessary usage of RawSQL which causes issues for backends that specialize the treatment of null ordering.
2022-10-04Fixed #34012 -- Made QuerySet.order_by() apply transforms on related fields ↵David Sanders
for models with Meta.ordering. This makes QuerySet.order_by() no longer ignore trailing transforms for models with Meta.ordering. As a consequence, FieldError is raised in such cases for non-existent fields. Thanks to Klaas van Schelven for the report and Mariusz Felisiak for the review and advice.
2022-09-22Refs #34012 -- Added test for ordering by transform of related fields.Mariusz Felisiak
2022-09-22Fixed #34015 -- Allowed filtering by transforms on relation fields.Mariusz Felisiak
2022-08-30Fixed #21204 -- Tracked field deferrals by field instead of models.Simon Charette
This ensures field deferral works properly when a model is involved more than once in the same query with a distinct deferral mask.
2022-07-27Refs #32948, Refs #32946 -- Used Q.create() internally for dynamic Q() objects.Nick Pope
Node.create() which has a compatible signature with Node.__init__() takes in a single `children` argument rather than relying in unpacking *args in Q.__init__() which calls Node.__init__(). In addition, we were often needing to unpack iterables into *args and can instead pass a list direct to Node.create().
2022-07-27Used AND, OR, XOR constants instead of hard-coded values.Nick Pope
2022-06-27Fixed #33796 -- Fixed ordered combined queryset crash when used in subquery ↵Mariusz Felisiak
on PostgreSQL and MySQL. Thanks Shai Berger for the report. Regression in 30a01441347d5a2146af2944b29778fa0834d4be.
2022-06-13Made QuerySet.bulk_update() raise an error when batch_size is zero.Ebram Shehata
2022-05-19Fixed #33717 -- Dropped support for PostgreSQL 11.Mariusz Felisiak
2022-05-04Refs #30581 -- Added Q.check() hook.Gagaro
2022-05-03Refs #30581 -- Added Q.flatten().Gagaro
2022-04-19Refs #32226 -- Fixed JSON format of QuerySet.explain() on PostgreSQL when ↵Mariusz Felisiak
format is uppercased. Follow up to aba9c2de669dcc0278c7ffde7981be91801be00b.
2022-04-14Relaxed some query ordering assertions in various tests.Mariusz Felisiak
It accounts for differences seen on MySQL with MyISAM storage engine.
2022-04-14Made select_for_update() don't raise TransactionManagementError on databases ↵Mariusz Felisiak
that don't support transactions.
2022-04-14Expanded QuerySet.explain() error message if a backend supports no formats.Tim Graham
2022-04-13Improved ExplainTests.test_basic().Mariusz Felisiak
QuerySet.select_for_update() is not supported by all databases. Moreover it cannot be used outside of a transaction.
2022-04-12Fixed #24296 -- Made QuerySet.exists() clear selected columns for not sliced ↵mgaligniana
distinct querysets.
2022-04-12Refs #18414 -- Added tests for selected columns of sliced distinct querysets.mgaligniana
2022-04-11Removed DatabaseFeatures.validates_explain_options.Mariusz Felisiak
Always True since 6723a26e59b0b5429a0c5873941e01a2e1bdbb81.
2022-04-11Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) against SQL ↵Mariusz Felisiak
injection on PostgreSQL.
2022-04-11Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), and ↵Mariusz Felisiak
extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report.
2022-03-16Refs #30581 -- Allowed sql.Query to be used without model.Gagaro
2022-03-04Fixed #29865 -- Added logical XOR support for Q() and querysets.Ryan Heard
2022-02-25Fixed #31486 -- Deprecated passing unsaved objects to related filters.Albert Defler
Co-Authored-By: Hasan Ramezani <hasan.r67@gmail.com>
2022-02-22Removed redundant QuerySet.all() calls in docs and tests.Nick Pope
Most QuerySet methods are mapped onto the Manager and, in general, it isn't necessary to call .all() on the manager.
2022-02-09Fixed #33506 -- Made QuerySet.bulk_update() perform atomic writes against ↵Simon Charette
write database. The lack of _for_write = True assignment in bulk_update prior to accessing self.db resulted in the db_for_read database being used to wrap batched UPDATEs in a transaction. Also tweaked the batch queryset creation to also ensure they are executed against the same database as the opened transaction under all circumstances. Refs #23646, #33501.
2022-02-07Refs #33476 -- Refactored code to strictly match 88 characters line length.Mariusz Felisiak
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2022-02-03Refs #33476 -- Refactored problematic code before reformatting by Black.Mariusz Felisiak
In these cases Black produces unexpected results, e.g. def make_random_password( self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyz' 'ABCDEFGHJKLMNPQRSTUVWXYZ' '23456789', ): or cursor.execute(""" SELECT ... """, [table name], )
2022-01-27Fixed #33463 -- Fixed QuerySet.bulk_update() with F() expressions.Jörg Breitbart
2022-01-17Fixed #29338 -- Allowed using combined queryset in Subquery.Mariusz Felisiak
Thanks Eugene Kovalev for the initial patch, Simon Charette for the review, and Chetan Khanna for help.
2021-12-08Fixed #33319 -- Fixed crash when combining with the | operator querysets ↵Ömer Faruk Abacı
with aliases that conflict.
2021-11-29Fixed #33322 -- Fixed loss of assigned related object when saving relation ↵Hannes Ljungberg
with bulk_update().
2021-11-19Refs #24121 -- Added __repr__() to BaseDatabaseWrapper, JoinPromoter, and ↵Jonny Park
SQLCompiler.
2021-10-08Refs #25467 -- Added test for excluding one-to-one relation with unsaved ↵Jacob Walls
objects. Fixed in 58da81a5a372a69f0bac801c412b57f3cce5f188.
generated by cgit v1.3 (git 2.53.0) at 2026-07-13 21:09:35 +0000