From 001b0634cd309e372edb6d7d95d083d02b8e37bd Mon Sep 17 00:00:00 2001 From: Carlton Gibson Date: Wed, 22 Jan 2020 09:03:27 +0100 Subject: [1.11.x] Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. --- tests/postgres_tests/test_aggregates.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'tests') diff --git a/tests/postgres_tests/test_aggregates.py b/tests/postgres_tests/test_aggregates.py index 9aa0e06595..ddfd7fce26 100644 --- a/tests/postgres_tests/test_aggregates.py +++ b/tests/postgres_tests/test_aggregates.py @@ -108,6 +108,10 @@ class TestGeneralAggregate(PostgreSQLTestCase): with self.assertRaises(TypeError): AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field')) + def test_string_agg_delimiter_escaping(self): + values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter="'")) + self.assertEqual(values, {'stringagg': "Foo1'Foo2'Foo3'Foo4"}) + def test_string_agg_charfield(self): values = AggregateTestModel.objects.aggregate(stringagg=StringAgg('char_field', delimiter=';')) self.assertEqual(values, {'stringagg': 'Foo1;Foo2;Foo3;Foo4'}) -- cgit v1.3