From 72d2c87431f2ae0431d65d0ec792047f078c8241 Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Wed, 24 Sep 2025 15:54:51 -0400 Subject: [5.1.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main. --- django/db/models/query_utils.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'django') diff --git a/django/db/models/query_utils.py b/django/db/models/query_utils.py index 1bf396723e..3584eea7e6 100644 --- a/django/db/models/query_utils.py +++ b/django/db/models/query_utils.py @@ -47,8 +47,12 @@ class Q(tree.Node): XOR = "XOR" default = AND conditional = True + connectors = (None, AND, OR, XOR) def __init__(self, *args, _connector=None, _negated=False, **kwargs): + if _connector not in self.connectors: + connector_reprs = ", ".join(f"{conn!r}" for conn in self.connectors[1:]) + raise ValueError(f"_connector must be one of {connector_reprs}, or None.") super().__init__( children=[*args, *sorted(kwargs.items())], connector=_connector, -- cgit v1.3