forked from pool/python-Django
109 lines
4.0 KiB
Diff
109 lines
4.0 KiB
Diff
From 251f22215061abaa5afddd8c8177cf658c8442e8 Mon Sep 17 00:00:00 2001
|
|
From: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
Date: Wed, 24 Sep 2025 15:54:51 -0400
|
|
Subject: [PATCH 2/3] [5.2.x] Fixed CVE-2025-62769 -- Prevented SQL injections
|
|
in Q/QuerySet via the _connector kwarg.
|
|
|
|
Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
|
|
Charette, and Jake Howard for the reviews.
|
|
---
|
|
django/db/models/query_utils.py | 4 ++++
|
|
docs/releases/4.2.26.txt | 7 +++++++
|
|
docs/releases/5.1.14.txt | 7 +++++++
|
|
docs/releases/5.2.8.txt | 7 +++++++
|
|
tests/queries/test_q.py | 5 +++++
|
|
5 files changed, 30 insertions(+)
|
|
|
|
diff --git a/django/db/models/query_utils.py b/django/db/models/query_utils.py
|
|
index d219c5fb0e..9d237cdc77 100644
|
|
--- a/django/db/models/query_utils.py
|
|
+++ b/django/db/models/query_utils.py
|
|
@@ -48,8 +48,12 @@ class Q(tree.Node):
|
|
XOR = "XOR"
|
|
default = AND
|
|
conditional = True
|
|
+ connectors = (None, AND, OR, XOR)
|
|
|
|
def __init__(self, *args, _connector=None, _negated=False, **kwargs):
|
|
+ if _connector not in self.connectors:
|
|
+ connector_reprs = ", ".join(f"{conn!r}" for conn in self.connectors[1:])
|
|
+ raise ValueError(f"_connector must be one of {connector_reprs}, or None.")
|
|
super().__init__(
|
|
children=[*args, *sorted(kwargs.items())],
|
|
connector=_connector,
|
|
diff --git a/tests/queries/test_q.py b/tests/queries/test_q.py
|
|
index 1a62aca061..52200b2ecf 100644
|
|
--- a/tests/queries/test_q.py
|
|
+++ b/tests/queries/test_q.py
|
|
@@ -272,6 +272,11 @@ class QTests(SimpleTestCase):
|
|
Q(*items, _connector=connector),
|
|
)
|
|
|
|
+ def test_connector_validation(self):
|
|
+ msg = f"_connector must be one of {Q.AND!r}, {Q.OR!r}, {Q.XOR!r}, or None."
|
|
+ with self.assertRaisesMessage(ValueError, msg):
|
|
+ Q(_connector="evil")
|
|
+
|
|
def test_referenced_base_fields(self):
|
|
# Make sure Q.referenced_base_fields retrieves all base fields from
|
|
# both filters and F expressions.
|
|
--
|
|
2.43.0
|
|
|
|
From b13864f3024abe7afd316081cdf7e67b3b984987 Mon Sep 17 00:00:00 2001
|
|
From: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
Date: Wed, 24 Sep 2025 15:56:03 -0400
|
|
Subject: [PATCH 3/3] [5.2.x] Refs CVE-2025-62769 -- Avoided propagating
|
|
invalid arguments to Q on dictionary expansion.
|
|
|
|
---
|
|
django/db/models/query.py | 5 +++++
|
|
tests/queries/tests.py | 8 ++++++++
|
|
2 files changed, 13 insertions(+)
|
|
|
|
diff --git a/django/db/models/query.py b/django/db/models/query.py
|
|
index 535d91d767..8ed028d140 100644
|
|
--- a/django/db/models/query.py
|
|
+++ b/django/db/models/query.py
|
|
@@ -42,6 +42,8 @@ MAX_GET_RESULTS = 21
|
|
# The maximum number of items to display in a QuerySet.__repr__
|
|
REPR_OUTPUT_SIZE = 20
|
|
|
|
+PROHIBITED_FILTER_KWARGS = frozenset(["_connector", "_negated"])
|
|
+
|
|
|
|
class BaseIterable:
|
|
def __init__(
|
|
@@ -1512,6 +1514,9 @@ class QuerySet(AltersData):
|
|
return clone
|
|
|
|
def _filter_or_exclude_inplace(self, negate, args, kwargs):
|
|
+ if invalid_kwargs := PROHIBITED_FILTER_KWARGS.intersection(kwargs):
|
|
+ invalid_kwargs_str = ", ".join(f"'{k}'" for k in sorted(invalid_kwargs))
|
|
+ raise TypeError(f"The following kwargs are invalid: {invalid_kwargs_str}")
|
|
if negate:
|
|
self._query.add_q(~Q(*args, **kwargs))
|
|
else:
|
|
diff --git a/tests/queries/tests.py b/tests/queries/tests.py
|
|
index ffaabf48a0..c1589669b0 100644
|
|
--- a/tests/queries/tests.py
|
|
+++ b/tests/queries/tests.py
|
|
@@ -4506,6 +4506,14 @@ class TestInvalidValuesRelation(SimpleTestCase):
|
|
Annotation.objects.filter(tag__in=[123, "abc"])
|
|
|
|
|
|
+class TestInvalidFilterArguments(TestCase):
|
|
+ def test_filter_rejects_invalid_arguments(self):
|
|
+ school = School.objects.create()
|
|
+ msg = "The following kwargs are invalid: '_connector', '_negated'"
|
|
+ with self.assertRaisesMessage(TypeError, msg):
|
|
+ School.objects.filter(pk=school.pk, _negated=True, _connector="evil")
|
|
+
|
|
+
|
|
class TestTicket24605(TestCase):
|
|
def test_ticket_24605(self):
|
|
"""
|
|
--
|
|
2.43.0
|
|
|