From 005d60d97c4dfb117503bdb6f2facfcaf9315d84 Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Wed, 21 Jan 2026 18:00:13 -0500 Subject: Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods. This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. --- tests/ordering/tests.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'tests/ordering') diff --git a/tests/ordering/tests.py b/tests/ordering/tests.py index afe2e3c22c..008f0239b3 100644 --- a/tests/ordering/tests.py +++ b/tests/ordering/tests.py @@ -18,7 +18,6 @@ from django.db.models import ( When, ) from django.db.models.functions import Length, Upper -from django.db.utils import DatabaseError from django.test import TestCase from .models import ( @@ -411,13 +410,19 @@ class OrderingTests(TestCase): self.assertNotEqual(qs[0].headline, "Backdated") relation = FilteredRelation("author") - qs2 = Article.objects.annotate(**{crafted: relation}).order_by(crafted) - with self.assertRaises(DatabaseError): + msg = ( + "FilteredRelation doesn't support aliases with periods " + "(got 'ordering_article.pub_date')." + ) + with self.assertRaisesMessage(ValueError, msg): + qs2 = Article.objects.annotate(**{crafted: relation}).order_by(crafted) # Before, unlike F(), which causes ordering expressions to be # replaced by ordinals like n in ORDER BY n, these were ordered by # pub_date instead of author. # The Article model orders by -pk, so sorting on author will place # first any article by author2 instead of the backdated one. + # This assertion is reachable if FilteredRelation.__init__() starts + # supporting periods in aliases in the future. self.assertNotEqual(qs2[0].headline, "Backdated") def test_order_by_pk(self): -- cgit v1.3