Opened 20 months ago

Last modified 14 months ago

#22014 new Bug

`prefetch_related` recursion protection does not cover all cases

Reported by: StillNewb Owned by: nobody
Component: Database layer (models, ORM) Version: master
Severity: Normal Keywords: prefetch
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no


This issue related to #17014

Commit (see line 1655):


prefetch_related collects additional prefetch lookups made by querysets that are created during prefetching, and handle them to in addition to lookups defined by user.
Sometimes it can casue infinite recursion, so for preventing that, there needed some mechanism that ensures that prefetches that was already done, would not be performed again.

Problems in the code:

Now that mechanism stores descriptors of relational fields and checks against them every iteration.
Python descriptor is shared against instances of classes. So descriptor represents relational field of model, not field of instance.
For same relation and different sets of instances there are different prefetch queries, so descriptors cant be used as identifiers for facts that lookup was already prefetched.
And I also would add that passing descriptors around is very much unpythonic and not healthy practice in general. Descriptors are advanced properties, they must serve for same purpose as properties - hiding some logic in attribute assigment/deletion/retrieving.

Reason here - is to identify lookups while traversing data relationships and never repeat them.
In code this reason is not well exporessed:

  • There is done_queries and followed_descriptors - two places for same thing.
  • Check is against descriptors, but in done_queries lookup paths is being added.
  • Check against lookup type (auto lookup or normal) is redundant, there is no difference between auto-lookups and normal lookups in matter of which allowed to spam, they must be checked for which was already done uniformly.

Specific problem is in the check condition for adding in done_lookups - not (lookup in auto_lookups and descriptor in followed_descriptors) - intention here was "if this is not autolookup, descriptor for which is already seen, and presumably lookup path for it was added to done_queries - not adding it to done_queries. So autolookup-spam will be stopped".
But what if descriptor for field, throug lookup-spam assumed to flow, was already added while performing different lookup with different data/parameters? If that lookup will be autolookup - it will never be added to done_queries and would be allowed to be performed infinity number of times.

There is too much unneeded complexity in that code.

Ive made the patch with two tests.

Attachments (1)

prefetch_recursion_protection_fail.diff (4.9 KB) - added by StillNewb 20 months ago.

Download all attachments as: .zip

Change History (5)

Changed 20 months ago by StillNewb

comment:1 Changed 17 months ago by bmispelon

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Resolution set to needsinfo
  • Status changed from new to closed


Correct me if I'm wrong, but from what I can tell, the test you provide doesn't demonstrate an infinite loop.

There does appear to be some repeated queries but I'm not familiar enough with the ORM internals to say whether it's actually a bug or a performance issue that we could improve.

I'll mark this ticket as "needs info". Can you reopen it with a testcase that shows the infinite recursion?


comment:2 Changed 16 months ago by Pashkin

  • Resolution needsinfo deleted
  • Status changed from closed to new

Yes, you right, in the patch I've demostrated one "step" of infinite recursion, now I wrote third test which really reproduces infinite recursion.
Here is the commit:

Version 0, edited 16 months ago by Pashkin (next)

comment:3 Changed 14 months ago by timo

  • Component changed from Uncategorized to Database layer (models, ORM)
  • Triage Stage changed from Unreviewed to Accepted

Confirmed the provided tests do fail.

comment:4 Changed 14 months ago by anonymous

I actually have fixed this bug in this app:

It adds feature for prefetching sequential GFK lookups and fixes this bug. Code from it can be ported to Django.

Note: See TracTickets for help on using tickets.
Back to Top