diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/aggregation/tests.py | 9 | ||||
| -rw-r--r-- | tests/annotations/tests.py | 43 | ||||
| -rw-r--r-- | tests/expressions/test_queryset_values.py | 9 | ||||
| -rw-r--r-- | tests/queries/tests.py | 9 |
4 files changed, 70 insertions, 0 deletions
diff --git a/tests/aggregation/tests.py b/tests/aggregation/tests.py index 3922478bf3..61da0ebfe7 100644 --- a/tests/aggregation/tests.py +++ b/tests/aggregation/tests.py @@ -2048,6 +2048,15 @@ class AggregateTestCase(TestCase): ) self.assertEqual(len(qs), 6) + def test_alias_sql_injection(self): + crafted_alias = """injected_name" from "aggregation_author"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Author.objects.aggregate(**{crafted_alias: Avg("age")}) + def test_exists_extra_where_with_aggregate(self): qs = Book.objects.annotate( count=Count("id"), diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py index 5106a377ac..52a268c4ae 100644 --- a/tests/annotations/tests.py +++ b/tests/annotations/tests.py @@ -1076,6 +1076,40 @@ class NonAggregateAnnotationTestCase(TestCase): ], ) + def test_alias_sql_injection(self): + crafted_alias = """injected_name" from "annotations_book"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Book.objects.annotate(**{crafted_alias: Value(1)}) + + def test_alias_forbidden_chars(self): + tests = [ + 'al"ias', + "a'lias", + "ali`as", + "alia s", + "alias\t", + "ali\nas", + "alias--", + "ali/*as", + "alias*/", + "alias;", + # [] are used by MSSQL. + "alias[", + "alias]", + ] + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + for crafted_alias in tests: + with self.subTest(crafted_alias): + with self.assertRaisesMessage(ValueError, msg): + Book.objects.annotate(**{crafted_alias: Value(1)}) + class AliasTests(TestCase): @classmethod @@ -1339,3 +1373,12 @@ class AliasTests(TestCase): with self.subTest(operation=operation): with self.assertRaisesMessage(FieldError, msg): getattr(qs, operation)("rating_alias") + + def test_alias_sql_injection(self): + crafted_alias = """injected_name" from "annotations_book"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Book.objects.alias(**{crafted_alias: Value(1)}) diff --git a/tests/expressions/test_queryset_values.py b/tests/expressions/test_queryset_values.py index 147f02fffb..0dba623167 100644 --- a/tests/expressions/test_queryset_values.py +++ b/tests/expressions/test_queryset_values.py @@ -34,6 +34,15 @@ class ValuesExpressionsTests(TestCase): [{"salary": 10}, {"salary": 20}, {"salary": 30}], ) + def test_values_expression_alias_sql_injection(self): + crafted_alias = """injected_name" from "expressions_company"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Company.objects.values(**{crafted_alias: F("ceo__salary")}) + def test_values_expression_group_by(self): # values() applies annotate() first, so values selected are grouped by # id, not firstname. diff --git a/tests/queries/tests.py b/tests/queries/tests.py index f9d2ebf98f..7b70a5ae0a 100644 --- a/tests/queries/tests.py +++ b/tests/queries/tests.py @@ -1898,6 +1898,15 @@ class Queries5Tests(TestCase): Note.objects.extra(select={"foo": "'bar %%s'"})[0].foo, "bar %s" ) + def test_extra_select_alias_sql_injection(self): + crafted_alias = """injected_name" from "queries_note"; --""" + msg = ( + "Column aliases cannot contain whitespace characters, quotation marks, " + "semicolons, or SQL comments." + ) + with self.assertRaisesMessage(ValueError, msg): + Note.objects.extra(select={crafted_alias: "1"}) + def test_queryset_reuse(self): # Using querysets doesn't mutate aliases. authors = Author.objects.filter(Q(name="a1") | Q(name="nonexistent")) |