File CVE-2025-57833.patch of Package python-Django.19101

From 31334e6965ad136a5e369993b01721499c5d1a92 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Wed, 13 Aug 2025 14:13:42 +0200
Subject: [PATCH] [4.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation
 against SQL injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
---
 django/db/models/sql/query.py |  1 +
 docs/releases/4.2.24.txt      |  7 +++++++
 tests/annotations/tests.py    | 24 ++++++++++++++++++++++++
 3 files changed, 32 insertions(+)

Index: Django-2.2.28/django/db/models/sql/query.py
===================================================================
--- Django-2.2.28.orig/django/db/models/sql/query.py
+++ Django-2.2.28/django/db/models/sql/query.py
@@ -1369,6 +1369,7 @@ class Query:
         return target_clause
 
     def add_filtered_relation(self, filtered_relation, alias):
+        self.check_alias(alias)
         filtered_relation.alias = alias
         lookups = dict(get_children_from_q(filtered_relation.condition))
         for lookup in chain((filtered_relation.relation_name,), lookups):
Index: Django-2.2.28/tests/annotations/tests.py
===================================================================
--- Django-2.2.28.orig/tests/annotations/tests.py
+++ Django-2.2.28/tests/annotations/tests.py
@@ -4,7 +4,7 @@ from decimal import Decimal
 from django.core.exceptions import FieldDoesNotExist, FieldError
 from django.db.models import (
     BooleanField, CharField, Count, DateTimeField, ExpressionWrapper, F, Func,
-    IntegerField, NullBooleanField, OuterRef, Q, Subquery, Sum, Value,
+    FilteredRelation, IntegerField, NullBooleanField, OuterRef, Q, Subquery, Sum, Value,
 )
 from django.db.models.expressions import RawSQL
 from django.db.models.functions import Length, Lower
@@ -608,6 +608,15 @@ class NonAggregateAnnotationTestCase(Tes
         with self.assertRaisesMessage(ValueError, msg):
             Book.objects.annotate(**{crafted_alias: Value(1)})
 
+    def test_alias_filtered_relation_sql_injection(self):
+        crafted_alias = """injected_name" from "annotations_book"; --"""
+        msg = (
+            "Column aliases cannot contain whitespace characters, quotation marks, "
+            "semicolons, or SQL comments."
+        )
+        with self.assertRaisesMessage(ValueError, msg):
+            Book.objects.annotate(**{crafted_alias: FilteredRelation("author")})
+
     def test_alias_forbidden_chars(self):
         tests = [
             'al"ias',
@@ -632,3 +641,8 @@ class NonAggregateAnnotationTestCase(Tes
             with self.subTest(crafted_alias):
                 with self.assertRaisesMessage(ValueError, msg):
                     Book.objects.annotate(**{crafted_alias: Value(1)})
+
+                with self.assertRaisesMessage(ValueError, msg):
+                    Book.objects.annotate(
+                        **{crafted_alias: FilteredRelation("authors")}
+                    )