#34831: Search in admin could allow issuing a query with many OR'd clauses
------------------------------------------------+------------------------
Reporter: Natalia Bidart | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: contrib.admin | Version: dev
Severity: Normal | Keywords:
Triage Stage: Accepted | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
------------------------------------------------+------------------------
As a logged in user, when performing searches in the django admin, a
request with a lot of terms separated by spaces could cause the server to
slow down because each term is OR'd, potentially building a bad query.
The root cause of this issue is a `for` loop in
`/django/contrib/admin/options.py`:
{{{#!python
if search_fields and search_term:
orm_lookups = [construct_search(str(search_field))
for search_field in search_fields]
for bit in smart_split(search_term):
if bit.startswith(('"', "'")):
bit = unescape_string_literal(bit)
or_queries = [models.Q(**{orm_lookup: bit})
for orm_lookup in orm_lookups]
queryset = queryset.filter(reduce(operator.or_,
or_queries))
use_distinct |= any(lookup_needs_distinct(self.opts,
search_spec) for search_spec in orm_lookups)
}}}
The value of the string `search_term` comes from the frontend input search
field and is then split with spaces using the `smart_split`.
Thanks Wenchao Li of Alibaba Group for the report.
--
Ticket URL: <https://code.djangoproject.com/ticket/34831>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/0107018a8986c374-6616614b-3bd5-4498-a4c5-bc9120e581eb-000000%40eu-central-1.amazonses.com.
