summaryrefslogtreecommitdiff
path: root/tests/annotations
AgeCommit message (Collapse)Author
2026-02-03Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via ↵Jake Howard
control characters. Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews.
2026-01-16Fixed #36352 -- Improved error message for fields excluded by prior ↵JaeHyuck Sa
values()/values_list() calls. Signed-off-by: JaeHyuck Sa <wogur981208@gmail.com>
2025-12-04Added DatabaseFeatures.prohibits_dollar_signs_in_column_aliases.Tim Graham
This is also applicable on CockroachDB.
2025-12-02Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in ↵Jacob Walls
column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews.
2025-10-01Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), ↵Mariusz Felisiak
and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.
2025-09-22Fixed #36480 -- Made values() resolving error mention unselected aliases.Shubham Singh
Follow-up to cb13792938f2c887134eb6b5164d89f8d8f9f1bd. Refs #34437.
2025-09-03Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in ↵Jake Howard
column aliases. Thanks Eyal Gabay (EyalSec) for the report.
2025-08-07Refs #36210 -- Added missing limits in Subquery tests.Jacob Walls
2025-07-23Refs #36500 -- Shortened some long docstrings and comments.Mike Edmunds
Manually reformatted some long docstrings and comments that would be damaged by the to-be-applied autofixer script, in cases where editorial judgment seemed necessary for style or wording changes.
2025-06-20Fixed #36152 -- Deprecated use of "%" in column aliases.Jacob Walls
Unintentional support existed only on SQLite and Oracle.
2025-04-05Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().Simon Charette
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Jeff Iadarola for the report and tests. Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
2025-01-30Fixed #36155 -- Improved error handling when annotate arguments require an ↵Vinko Mlačić
alias. Regression in ed0cbc8d8b314e3b4a0305d0be3cf366d8ee4a74.
2024-08-12Fixed #35586 -- Added support for set-returning database functions.Devin Cox
Aggregation optimization didn't account for not referenced set-returning annotations on Postgres. Co-authored-by: Simon Charette <charette.s@gmail.com>
2024-07-03Refs #28900 -- Made SELECT respect the order specified by values(*selected).Simon Charette
Previously the order was always extra_fields + model_fields + annotations with respective local ordering inferred from the insertion order of *selected. This commits introduces a new `Query.selected` propery that keeps tracks of the global select order as specified by on values assignment. This is crucial feature to allow the combination of queries mixing annotations and table references. It also allows the removal of the re-ordering shenanigans perform by ValuesListIterable in order to re-map the tuples returned from the database backend to the order specified by values_list() as they'll be in the right order at query compilation time. Refs #28553 as the initially reported issue that was only partially fixed for annotations by d6b6e5d0fd4e6b6d0183b4cf6e4bd4f9afc7bf67. Thanks Mariusz Felisiak and Sarah Boyce for review.
2023-03-25Fixed #34437 -- Made values() resolving error mention selected annotations.Simon Charette
While the add_fields() call from set_values() does trigger validation it does so after annotations are masked resulting in them being excluded from the choices of valid options surfaced through a FieldError.
2023-01-26Fixed #34254 -- Fixed return value of Exists() with empty queryset.Raj Desai
Thanks Simon Charette for reviews.
2022-11-07Refs #33374 -- Adjusted full match condition handling.Simon Charette
Adjusting WhereNode.as_sql() to raise an exception when encoutering a full match just like with empty matches ensures that all case are explicitly handled.
2022-11-07Refs #17144 -- Removed support for grouping by primary key.Simon Charette
No core backend require the feature anymore as it was only added to support a MySQL'ism that has been deprecated since then.
2022-10-08Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to ↵Gregor Gärtner
assertQuerySetEqual(). Co-Authored-By: Michael Howitz <mh@gocept.com>
2022-09-09Fixed #33975 -- Fixed __in lookup when rhs is a queryset with annotate() and ↵DevilsAutumn
alias(). This fixes clearing selected fields.
2022-04-14Relaxed some query ordering assertions in various tests.Mariusz Felisiak
It accounts for differences seen on MySQL with MyISAM storage engine.
2022-04-11Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), and ↵Mariusz Felisiak
extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report.
2022-03-30Refs #33397 -- Added extra tests for resolving an output_field of ↵Luke Plant
CombinedExpression.
2022-02-07Refs #33476 -- Refactored code to strictly match 88 characters line length.Mariusz Felisiak
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2022-02-03Refs #33476 -- Refactored problematic code before reformatting by Black.Mariusz Felisiak
In these cases Black produces unexpected results, e.g. def make_random_password( self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyz' 'ABCDEFGHJKLMNPQRSTUVWXYZ' '23456789', ): or cursor.execute(""" SELECT ... """, [table name], )
2021-12-21Fixed #33374 -- Fixed ExpressionWrapper annotations with full queryset.David Wobrock
2021-09-29Fixed #33018 -- Fixed annotations with empty queryset.David Wobrock
Thanks Simon Charette for the review and implementation idea.
2021-07-07Used more specific unittest assertions in tests.Mads Jensen
2021-01-14Refs #31369 -- Removed models.NullBooleanField per deprecation timeline.Mariusz Felisiak
2020-12-10Fixed #32178 -- Allowed database backends to skip tests and mark expected ↵Hasan Ramezani
failures. Co-authored-by: Tim Graham <timograham@gmail.com>
2020-11-27Fixed #25534, Fixed #31639 -- Added support for transform references in ↵Ian Foote
expressions. Thanks Mariusz Felisiak and Simon Charette for reviews.
2020-11-19Fixed #32200 -- Fixed grouping by ExpressionWrapper() with Q objects.Hasan Ramezani
Thanks Gordon Wrigley for the report. Regression in df32fd42b84cc6dbba173201f244491b0d154a63.
2020-10-29Fixed #32152 -- Fixed grouping by subquery aliases.Christian Klus
Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe. Thanks Simon Charette for the review.
2020-09-16Refs #32007 -- Skipped test_q_expression_annotation_with_aggregation on Oracle.Mariusz Felisiak
2020-09-15Fixed #32007 -- Fixed queryset crash with Q() annotation and aggregation.Mariusz Felisiak
Thanks Gordon Wrigley for the report. Regression in 8a6df55f2dd5131282084a4edfd48f63fbf8c69a.
2020-08-17Fixed #31888 -- Avoided module-level MySQL queries in tests.Ahmad A. Hussein
2020-07-31Fixed #27719 -- Added QuerySet.alias() to allow creating reusable aliases.Alexandr Tatarinov
QuerySet.alias() allows creating reusable aliases for expressions that don't need to be selected but are used for filtering, ordering, or as a part of complex expressions. Thanks Simon Charette for reviews.
2020-07-30Bumped minimum isort version to 5.1.0.David Smith
Fixed inner imports per isort 5. isort 5.0.0 to 5.1.0 was unstable.
2020-07-15Refs #30446 -- Removed unnecessary Value(..., output_field) in docs and tests.Simon Charette
2020-07-09Fixed #31773 -- Fixed preserving output_field in ExpressionWrapper for ↵Mariusz Felisiak
combined expressions. Thanks Thodoris Sotiropoulos for the report and Simon Charette for the implementation idea. Regression in df32fd42b84cc6dbba173201f244491b0d154a63.
2020-06-12Fixed #31659 -- Made ExpressionWrapper preserve output_field for combined ↵Mariusz Felisiak
expressions. Regression in df32fd42b84cc6dbba173201f244491b0d154a63. Thanks Simon Charette for the review.
2020-06-08Fixed #31660 -- Fixed queryset crash when grouping by m2o relation.Mariusz Felisiak
Regression in 3a941230c85b2702a5e1cd97e17251ce21057efa. Thanks Tomasz Szymański for the report.
2020-05-14Fixed #31584 -- Fixed crash when chaining values()/values_list() after ↵Mariusz Felisiak
Exists() annotation and aggregation on Oracle. Oracle requires the EXISTS expression to be wrapped in a CASE WHEN in the GROUP BY clause. Regression in efa1908f662c19038a944129c81462485c4a9fe8.
2020-05-14Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() ↵Simon Charette
after annotate() with aggregations and subqueries. Subquery annotation references must be resolved if they are excluded from the GROUP BY clause by a following .values() call. Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80. Thanks Makina Corpus for the report.
2020-04-30Removed unused __str__() methods in tests models.Mariusz Felisiak
Follow up to 6461583b6cc257d25880ef9a9fd7e2125ac53ce1.
2020-04-15Removed unused __str__() methods in tests models.Author: Mads Jensen
Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com> Co-Authored-By: Hasan Ramezani <hasan.r67@gmail.com>
2019-11-18Relaxed some query ordering assertions in tests.Tim Graham
It accounts for differences seen on cockroachdb.
2019-07-11Fixed #28289 -- Fixed crash of RawSQL annotations on inherited model fields.can
2019-03-21Refs #29542, #30158 -- Enabled a HAVING subquery filter test on Oracle.Simon Charette
Now that subquery annotations aren't included in the GROUP BY unless explicitly grouped against, the test works on Oracle.
generated by cgit v1.3 (git 2.53.0) at 2026-05-02 04:23:48 +0000