File CVE-2025-57833.patch of Package python-Django.40375

From 251253f36ac5594fb009c09a96f9132323923b78 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Wed, 13 Aug 2025 14:13:42 +0200
Subject: [PATCH] [4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation
 against SQL injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.

Backport of 958ad4b7ccc356d7c50b4162c40ff5ad08d79850 from main.
---
 django/db/models/sql/query.py |  1 +
 docs/releases/4.2.24.txt      |  7 +++++++
 tests/annotations/tests.py    | 24 ++++++++++++++++++++++++
 3 files changed, 32 insertions(+)

Index: Django-4.2.11/django/db/models/sql/query.py
===================================================================
--- Django-4.2.11.orig/django/db/models/sql/query.py
+++ Django-4.2.11/django/db/models/sql/query.py
@@ -1620,6 +1620,7 @@ class Query(BaseExpression):
         return target_clause
 
     def add_filtered_relation(self, filtered_relation, alias):
+        self.check_alias(alias)
         filtered_relation.alias = alias
         lookups = dict(get_children_from_q(filtered_relation.condition))
         relation_lookup_parts, relation_field_parts, _ = self.solve_lookup_type(
Index: Django-4.2.11/tests/annotations/tests.py
===================================================================
--- Django-4.2.11.orig/tests/annotations/tests.py
+++ Django-4.2.11/tests/annotations/tests.py
@@ -12,6 +12,7 @@ from django.db.models import (
     Exists,
     ExpressionWrapper,
     F,
+    FilteredRelation,
     FloatField,
     Func,
     IntegerField,
@@ -1121,6 +1122,15 @@ class NonAggregateAnnotationTestCase(Tes
         with self.assertRaisesMessage(ValueError, msg):
             Book.objects.annotate(**{crafted_alias: Value(1)})
 
+    def test_alias_filtered_relation_sql_injection(self):
+        crafted_alias = """injected_name" from "annotations_book"; --"""
+        msg = (
+            "Column aliases cannot contain whitespace characters, quotation marks, "
+            "semicolons, or SQL comments."
+        )
+        with self.assertRaisesMessage(ValueError, msg):
+            Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
+
     def test_alias_forbidden_chars(self):
         tests = [
             'al"ias',
@@ -1146,6 +1156,11 @@ class NonAggregateAnnotationTestCase(Tes
                 with self.assertRaisesMessage(ValueError, msg):
                     Book.objects.annotate(**{crafted_alias: Value(1)})
 
+                with self.assertRaisesMessage(ValueError, msg):
+                    Book.objects.annotate(
+                        **{crafted_alias: FilteredRelation("authors")}
+                    )
+
 
 class AliasTests(TestCase):
     @classmethod
@@ -1418,3 +1433,12 @@ class AliasTests(TestCase):
         )
         with self.assertRaisesMessage(ValueError, msg):
             Book.objects.alias(**{crafted_alias: Value(1)})
+
+    def test_alias_filtered_relation_sql_injection(self):
+        crafted_alias = """injected_name" from "annotations_book"; --"""
+        msg = (
+            "Column aliases cannot contain whitespace characters, quotation marks, "
+            "semicolons, or SQL comments."
+        )
+        with self.assertRaisesMessage(ValueError, msg):
+            Book.objects.alias(**{crafted_alias: FilteredRelation("authors")})