Always quote user-provided aliases

[Jacob Walls]

As part of evaluating CVE-2025-13372 (mitigated in 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e), Simon Charette observed that we could reduce the potential for mistakes in this area by systematically quoting user-provided aliases, instead of checking aliases against FORBIDDEN_ALIAS_PATTERN:

... the root of the problem here is that we don't perform alias quoting when they are provided by the user as on some backends they are treated differently mainly regarding case (e.g. "foo" != "FOO" on Postgres). If we did systematically quote aliases most of the FORBIDDEN_ALIAS_PATTERN logic would be unnecessary (as long as we escape quotes in aliases) as aliases would always be quoted.

There is work to do and deprecation cycles to put in place (mainly regarding extra(...) usage) if we want to venture that way (particularly regarding subqueries) but try ... the following patch

django/db/models/expressions.py

@@ -1322 +1322 @@
     def as_sql(self, compiler, connection):
         alias, column = self.alias, self.target.column
         identifiers = (alias, column) if alias else (column,)
-        sql = ".".join(map(compiler.quote_name_unless_alias, identifiers))
+        sql = ".".join(map(compiler.quote_name, identifiers))
         return sql, ()
 
     def relabeled_clone(self, relabels):

django/db/models/sql/datastructures.py

@@ -125 +125 @@
         sql = "%s %s%s ON (%s)" % (
             self.join_type,
             qn(self.table_name),
-            alias_str,
+            qn(alias_str),
             on_clause_sql,
         )
         return sql, params

(Notice that is *not* a complete patch but rather a sketch to send a contributor down a fruitful path.)

With agreement from the Security Team, Simon's recommendation was that after the mitigation we should:

... investigate how much work it would be to treat user vs system generated aliases differently in a public ticket.

[Simon Charette]

Thanks for creating an actionable item out of this Jacob, I can self assign and look into it during the holidays.