F expression literals should use bind parameters

[Erin Kelly]

To prevent SQL injection attacks, Python values used within F() expressions should be processed as bind parameters rather than be inserted directly into the SQL.

[Erin Kelly]

The first patch doesn't quite work. It successfully passes non-string types as bind parameters, but string values were still just getting processed by quote_name, and string values are the most dangerous.

The new patch fixes this by removing the attempt to process the value with quote_name entirely. This introduces a minor backward incompatibility, since it's no longer possible to do things like .filter(amount__lt=F('max_amount')-'surplus') and have 'surplus' automatically be included as a field name. But this can still be accomplished by using F('surplus') instead, which is better anyway since it's explicit.

[Alex Gaynor]

Yeah that's defintely an improvement F('field') - 'string' shouldn't turn 'string' into a fieldname automatically.

[Russell Keith-Magee]

(In [9820]) Fixed #10160 -- Modified evaluation of F() expressions to protect against potential SQL injection attacks. Thanks to Ian Kelly for the suggestion and patch.