Opened 3 weeks ago

Last modified 3 days ago

#37203 closed Bug

Escaped database metadata in inspectdb generated model code — at Version 1

Reported by: Mundur Owned by:
Component: Core (Management commands) Version: dev
Severity: Normal Keywords: inspectdb, compositeprimarykey
Cc: Mundur Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by David Smith)

inspectdb generates Python model source from database metadata. Most generated metadata already uses repr-style escaping, but two paths still interpolate database-provided values directly into generated source text:

  • composite primary-key column names in models.CompositePrimaryKey(...)
  • table names and exception messages emitted in introspection-error comments

This can produce invalid or unintended generated model code for unusual database schemas containing quotes or newlines.

Proposed fix:

  • render CompositePrimaryKey column names with repr()
  • render introspection-error table names/messages with repr-style output
  • add regression tests for both paths

A pull request with tests is available:
​https://github.com/django/django/pull/21581

Change History (1)

comment:1 by David Smith, 3 weeks ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.
Back to Top