[Django] #36778: Extend admonition to avoid constructing query expressions from unsanitized user input

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob | Owner: Jacob Walls
Walls |
Type: | Status: assigned
Cleanup/optimization |
Component: | Version:
Documentation | Keywords: Func, sql,
Severity: Normal | injection
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
The Security Team occasionally receives reports where a proof of concept
pipes unsanitized user input directly to a query expression argument
traditionally regarded as statically configured and thus developer-
controlled.

We haven't accepted these as vulnerabilities, because each case we've
confronted has a clear domain to validate (e.g. positive integers) that a
garden-variety form or serializer would handle, as opposed to anything
that would require the db adapter to escape.

We have this [https://docs.djangoproject.com/en/6.0/ref/models/expressions
/#avoiding-sql-injection clearly documented in the Func API] where
positional arguments can be user-driven but keyword arguments get
interpolated directly into SQL (beware!), but this is potentially muddled
by the inconsistency where some subclasses allow positional arguments for
convenience but then pass that on to `Func()` via keyword (beware!)

Working on a way to clarify this in the Func docs and cross-link from the
security reporting guidelines.
--
Ticket URL: <https://code.djangoproject.com/ticket/36778>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------

Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:
Keywords: Func, sql, | Triage Stage: Accepted
injection, extra, rawsql |
Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* keywords: Func, sql, injection => Func, sql, injection, extra, rawsql
* stage: Unreviewed => Accepted
* version: => dev

--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:1>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:
Keywords: Func, sql, | Triage Stage: Accepted
injection, extra, rawsql |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

Thank you!
--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:2>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:
Keywords: Func, sql, | Triage Stage: Accepted
injection, extra, rawsql |

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* has_patch: 0 => 1

Comment:

[https://github.com/django/django/pull/20376 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:3>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:
Keywords: Func, sql, | Triage Stage: Accepted
injection, extra, rawsql |
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Jacob Walls):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:4>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:
Keywords: Func, sql, | Triage Stage: Accepted
injection, extra, rawsql |
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Jacob Walls):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:5>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: assigned
Component: Documentation | Version: dev
Severity: Normal | Resolution:

Keywords: Func, sql, | Triage Stage: Ready for
injection, extra, rawsql | checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Clifford Gama):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:6>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls

Cleanup/optimization | Status: closed
Component: Documentation | Version: dev
Severity: Normal | Resolution: fixed

Keywords: Func, sql, | Triage Stage: Ready for
injection, extra, rawsql | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls <jacobtylerwalls@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"334308efae8e0c7b1523d5583af32b674a098eba" 334308e]:
{{{#!CommitTicketReference repository=""
revision="334308efae8e0c7b1523d5583af32b674a098eba"
Fixed #36778 -- Extended advice to sanitize input before using in query
expressions.

Thanks Clifford Gama and Simon Charette for reviews.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:7>

[Django]

#36778: Extend admonition to avoid constructing query expressions from unsanitized
user input
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Jacob
Type: | Walls
Cleanup/optimization | Status: closed
Component: Documentation | Version: dev
Severity: Normal | Resolution: fixed
Keywords: Func, sql, | Triage Stage: Ready for
injection, extra, rawsql | checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"189dcb1002ef6582cfc8074c09cb6e47d6034dd8" 189dcb1]:
{{{#!CommitTicketReference repository=""
revision="189dcb1002ef6582cfc8074c09cb6e47d6034dd8"
[6.0.x] Fixed #36778 -- Extended advice to sanitize input before using in

query expressions.

Thanks Clifford Gama and Simon Charette for reviews.

Backport of 334308efae8e0c7b1523d5583af32b674a098eba from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36778#comment:8>