From 93cae5cb2f9a4ef1514cf1a41f714fef08005200 Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Fri, 1 Apr 2022 08:10:22 +0200 Subject: Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), and extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report. --- tests/aggregation/tests.py | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'tests/aggregation') diff --git a/tests/aggregation/tests.py b/tests/aggregation/tests.py index 3922478bf3..61da0ebfe7 100644 --- a/tests/aggregation/tests.py +++ b/tests/aggregation/tests.py @@ -2048,6 +2048,15 @@ class AggregateTestCase(TestCase): ) self.assertEqual(len(qs), 6) + def test_alias_sql_injection(self): + crafted_alias = """injected_name" from "aggregation_author"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Author.objects.aggregate(**{crafted_alias: Avg("age")}) + def test_exists_extra_where_with_aggregate(self): qs = Book.objects.annotate( count=Count("id"), -- cgit v1.3