#36152: Postgres backend could quote `%` in column aliases instead of failing at
the db level
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Database layer | Version: 5.1
(models, ORM) |
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Simon Charette):
If we are going to do that we'd need to be particularly careful here as
annotations have been [https://www.djangoproject.com/weblog/2022/apr/11
/security-releases/ a vector of SQL injection] in the past.
I think we should instead include `%` in `FORBIDDEN_ALIAS_PATTERN` as by
the time comes to escaping the SQL is mixed up with actual placeholders
`%s` and now alias names. I wouldn't be surprised if the fact we allow `%`
today could be exploited one way to leak some parameter that should be
present in the `WHERE` clause for example.
The naive approach of adjusting `SQLCompiler.get_select` to escape percent
signs could cause more harm than good as PEP-249 allows for
`Cursor.execute` to be called with and without `params: tuple | None` and
when `None` is provided no parameter interpolation takes place so the
prior escaping would now assign the wrong alias.
In summary I think we should either wont-fix that one or accept in on the
basis of augmenting `FORBIDDEN_ALIAS_PATTERN`.
--
Ticket URL: <https://code.djangoproject.com/ticket/36152#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/01070194ad8799f7-c972e40d-fa71-46ce-bb21-45eea79417c7-000000%40eu-central-1.amazonses.com.
