diff options
Diffstat (limited to 'docs/ref/models')
| -rw-r--r-- | docs/ref/models/database-functions.txt | 3 | ||||
| -rw-r--r-- | docs/ref/models/expressions.txt | 10 |
2 files changed, 12 insertions, 1 deletions
diff --git a/docs/ref/models/database-functions.txt b/docs/ref/models/database-functions.txt index 00c94f0350..3692a4ada5 100644 --- a/docs/ref/models/database-functions.txt +++ b/docs/ref/models/database-functions.txt @@ -9,7 +9,8 @@ The classes documented below provide a way for users to use functions provided by the underlying database as annotations, aggregations, or filters in Django. Functions are also :doc:`expressions </ref/models/expressions>`, so they can be used and combined with other expressions like :ref:`aggregate functions -<aggregation-functions>`. +<aggregation-functions>`. See the :class:`~django.db.models.Func` documentation +for security considerations. We'll be using the following model in examples of each function:: diff --git a/docs/ref/models/expressions.txt b/docs/ref/models/expressions.txt index cda17eba63..965d1b8c5e 100644 --- a/docs/ref/models/expressions.txt +++ b/docs/ref/models/expressions.txt @@ -432,6 +432,16 @@ replace the attributes of the same name without having to define your own class. :ref:`output_field<output-field>` can be used to define the expected return type. +.. admonition:: Sanitize input used to configure a query expression + + Built-in database functions (such as + :class:`~django.db.models.functions.Cast`) vary in whether arguments such + as ``output_field`` can be supplied positionally or only by keyword. For + ``output_field`` and several other cases, the input ultimately reaches + ``Func()`` as a keyword argument, so the advice to avoid constructing + keyword arguments from untrusted user input applies as equally to these + arguments as it does to ``**extra``. + ``Aggregate()`` expressions --------------------------- |