mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-04-19 07:46:27 +00:00
151e634ed2
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q() were subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-64459 https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html Upstream-patch:72d2c874314624ed769cSigned-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
64 lines
2.2 KiB
Diff
64 lines
2.2 KiB
Diff
From 415912be531179e90e69f0be2e8bca301de53765 Mon Sep 17 00:00:00 2001
|
|
From: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
Date: Wed, 24 Sep 2025 15:56:03 -0400
|
|
Subject: [PATCH] [5.1.x] Refs CVE-2025-64459 -- Avoided propagating
|
|
invalid arguments to Q on dictionary expansion.
|
|
|
|
Backport of 3c3f46357718166069948625354b8315a8505262 from main.
|
|
|
|
CVE: CVE-2025-64459
|
|
|
|
Upstream-Status: Backport [https://github.com/django/django/commit/4624ed769c0f7caea0d48ac824a75fa6b6f17671]
|
|
|
|
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
|
|
---
|
|
django/db/models/query.py | 5 +++++
|
|
tests/queries/tests.py | 8 ++++++++
|
|
2 files changed, 13 insertions(+)
|
|
|
|
diff --git a/django/db/models/query.py b/django/db/models/query.py
|
|
index 153fb1193ebf..3308cd48db00 100644
|
|
--- a/django/db/models/query.py
|
|
+++ b/django/db/models/query.py
|
|
@@ -42,6 +42,8 @@ MAX_GET_RESULTS = 21
|
|
# The maximum number of items to display in a QuerySet.__repr__
|
|
REPR_OUTPUT_SIZE = 20
|
|
|
|
+PROHIBITED_FILTER_KWARGS = frozenset(["_connector", "_negated"])
|
|
+
|
|
|
|
class BaseIterable:
|
|
def __init__(
|
|
@@ -1495,6 +1497,9 @@ class QuerySet(AltersData):
|
|
return clone
|
|
|
|
def _filter_or_exclude_inplace(self, negate, args, kwargs):
|
|
+ if invalid_kwargs := PROHIBITED_FILTER_KWARGS.intersection(kwargs):
|
|
+ invalid_kwargs_str = ", ".join(f"'{k}'" for k in sorted(invalid_kwargs))
|
|
+ raise TypeError(f"The following kwargs are invalid: {invalid_kwargs_str}")
|
|
if negate:
|
|
self._query.add_q(~Q(*args, **kwargs))
|
|
else:
|
|
diff --git a/tests/queries/tests.py b/tests/queries/tests.py
|
|
index 20665ab2cda3..5df231949194 100644
|
|
--- a/tests/queries/tests.py
|
|
+++ b/tests/queries/tests.py
|
|
@@ -4481,6 +4481,14 @@ class TestInvalidValuesRelation(SimpleTestCase):
|
|
Annotation.objects.filter(tag__in=[123, "abc"])
|
|
|
|
|
|
+class TestInvalidFilterArguments(TestCase):
|
|
+ def test_filter_rejects_invalid_arguments(self):
|
|
+ school = School.objects.create()
|
|
+ msg = "The following kwargs are invalid: '_connector', '_negated'"
|
|
+ with self.assertRaisesMessage(TypeError, msg):
|
|
+ School.objects.filter(pk=school.pk, _negated=True, _connector="evil")
|
|
+
|
|
+
|
|
class TestTicket24605(TestCase):
|
|
def test_ticket_24605(self):
|
|
"""
|
|
--
|
|
2.34.1
|
|
|