From eb31d845323618d688ad429479c6dda973056136 Mon Sep 17 00:00:00 2001 From: Simon Charette Date: Tue, 31 Dec 2019 12:46:06 -0500 Subject: Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. --- tests/postgres_tests/test_aggregates.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'tests/postgres_tests') diff --git a/tests/postgres_tests/test_aggregates.py b/tests/postgres_tests/test_aggregates.py index af84f12e91..a1dbe4441c 100644 --- a/tests/postgres_tests/test_aggregates.py +++ b/tests/postgres_tests/test_aggregates.py @@ -169,6 +169,10 @@ class TestGeneralAggregate(PostgreSQLTestCase): with self.assertRaises(TypeError): AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field')) + def test_string_agg_delimiter_escaping(self): + values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter="'")) + self.assertEqual(values, {'stringagg': "Foo1'Foo2'Foo4'Foo3"}) + def test_string_agg_charfield(self): values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter=';')) self.assertEqual(values, {'stringagg': 'Foo1;Foo2;Foo4;Foo3'}) -- cgit v1.3