diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-04-01 13:48:47 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-04-11 08:59:58 +0200 |
| commit | 6723a26e59b0b5429a0c5873941e01a2e1bdbb81 (patch) | |
| tree | 59bbe514736c482903de4d92046e9f58594680d3 /django/db/models/sql/query.py | |
| parent | 93cae5cb2f9a4ef1514cf1a41f714fef08005200 (diff) | |
| download | django-6723a26e59b0b5429a0c5873941e01a2e1bdbb81.tar.gz | |
Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) against SQL injection on PostgreSQL.
Diffstat (limited to 'django/db/models/sql/query.py')
| -rw-r--r-- | django/db/models/sql/query.py | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py index 894aa7db4a..a55eb84a17 100644 --- a/django/db/models/sql/query.py +++ b/django/db/models/sql/query.py @@ -49,6 +49,10 @@ __all__ = ["Query", "RawQuery"] # SQL comments are forbidden in column aliases. FORBIDDEN_ALIAS_PATTERN = _lazy_re_compile(r"['`\"\]\[;\s]|--|/\*|\*/") +# Inspired from +# https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS +EXPLAIN_OPTIONS_PATTERN = _lazy_re_compile(r"[\w\-]+") + def get_field_names_from_opts(opts): if opts is None: @@ -589,6 +593,12 @@ class Query(BaseExpression): def explain(self, using, format=None, **options): q = self.clone() + for option_name in options: + if ( + not EXPLAIN_OPTIONS_PATTERN.fullmatch(option_name) + or "--" in option_name + ): + raise ValueError(f"Invalid option name: {option_name!r}.") q.explain_info = ExplainInfo(format, options) compiler = q.get_compiler(using=using) return "\n".join(compiler.explain_query()) |