From 59ae82e67053d281ff4562a24bbba21299f0a7d4 Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Wed, 24 Sep 2025 15:54:51 -0400 Subject: [4.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main. --- tests/queries/test_q.py | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'tests') diff --git a/tests/queries/test_q.py b/tests/queries/test_q.py index cdf40292b0..5f20a41768 100644 --- a/tests/queries/test_q.py +++ b/tests/queries/test_q.py @@ -225,6 +225,11 @@ class QTests(SimpleTestCase): Q(*items, _connector=connector), ) + def test_connector_validation(self): + msg = f"_connector must be one of {Q.AND!r}, {Q.OR!r}, {Q.XOR!r}, or None." + with self.assertRaisesMessage(ValueError, msg): + Q(_connector="evil") + class QCheckTests(TestCase): def test_basic(self): -- cgit v1.3