Re: Escaping of JSON attributes and CVE-2024-42005

2024-08-30 Thread charettes
Hello Ole, this was discussed during the security enforcement patch design but wasn't part of the public announcement unfortunately. The solution is to alias a KT[0] expression and then filter against it. In you particular example that would be from django.db.models import KT SomeModel.objects

Escaping of JSON attributes and CVE-2024-42005

2024-08-28 Thread Ole Laursen
Hi! Regarding the .values() problem with JSON fields, has anyone as of yet thought about how escaping of attribute names in JSON fields is supposed to work? We are using a JSON field to store user-defined extension fields. So say the user wants a "foo" text field. Then we'd store: o.data =