inspectdb doesn't account for normalized field names when building CompositePrimaryKey

[Mundur]

inspectdb generates Python model source from database metadata. Most generated metadata already uses repr-style escaping, but two paths still interpolate database-provided values directly into generated source text:

• composite primary-key column names in models.CompositePrimaryKey(...)
• table names and exception messages emitted in introspection-error comments

This can produce invalid or unintended generated model code for unusual database schemas containing quotes or newlines.

Proposed fix:

• render CompositePrimaryKey column names with repr()
• render introspection-error table names/messages with repr-style output
• add regression tests for both paths

A pull request with tests is available:
​https://github.com/django/django/pull/21581

[Jacob Walls]

Thanks for the report. Your test demonstrates a more serious issue than the invalid python identifiers -- we're calculating the field names for the positional arguments to CompositePrimaryKey before those field names are potentially rewritten in normalize_col_name(). In other words, your provided test asserts that the first positional argument is x', 'safe');__import__('os').system('echo unsafe')#, but it should really be x_safe_import_os_system_echo_unsafe_field.

We can fix the repr() inconsistencies you found along the way, but I'd like to reframe this ticket along the above lines. If you continue with this, please assign yourself in the owner field, and please also choose a simpler example -- the given example is giving "security exploit", but that's a distraction here (deploying a malicious column name implies full system compromise already).

[Jacob Walls]

Thanks for the pull request. When the comments are addressed, please unset "Patch needs improvement".

[Jacob Walls]

Left a note about removing mocks.

[Jacob Walls <jacobtylerwalls@…>]

In d8cedca:

Refs #37203 -- Escaped introspection error comments in inspectdb.

[Jacob Walls <jacobtylerwalls@…>]

In 2a5da9d0:

Fixed #37203 -- Used normalized field names for composite pks in inspectdb.