From 01d2d770e22bffe53c7f1e611e2bbca94cb8a2e7 Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Wed, 10 Sep 2025 09:53:52 +0200 Subject: [5.1.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main. --- tests/queries/tests.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'tests/queries') diff --git a/tests/queries/tests.py b/tests/queries/tests.py index 7ac8a65d42..f76a368021 100644 --- a/tests/queries/tests.py +++ b/tests/queries/tests.py @@ -1964,8 +1964,8 @@ class Queries5Tests(TestCase): def test_extra_select_alias_sql_injection(self): crafted_alias = """injected_name" from "queries_note"; --""" msg = ( - "Column aliases cannot contain whitespace characters, quotation marks, " - "semicolons, or SQL comments." + "Column aliases cannot contain whitespace characters, hashes, quotation " + "marks, semicolons, or SQL comments." ) with self.assertRaisesMessage(ValueError, msg): Note.objects.extra(select={crafted_alias: "1"}) -- cgit v1.3