Changes between Version 9 and Version 10 of SecurityTeam

Timestamp:

Oct 3, 2025, 1:49:12 PM (31 hours ago)

Author:

Natalia Bidart

Comment:

Added canned response for extra, raw, and RawSQL. Thanks charettes for the text.

SecurityTeam

@@ -76 +76 @@
 [1] https://docs.djangoproject.com/en/stable/internals/security/#how-does-django-evaluate-a-report
 
+=== SQL Injection via extra, raw or RawSQL ===
+
+Hello!
+
+Thank you for taking the time to submit your discoveries responsibly.
+
+After reviewing your report, we have concluded that it does not constitute a security issue. The behavior presented relies on the use of `QuerySet.extra`, `QuerySet.raw`, or `RawSQL` expressions, which are explicitly designed to execute arbitrary SQL. These APIs are documented to require that user-controllable input be passed via `params` as shown below:
+
+* https://docs.djangoproject.com/en/stable/ref/models/querysets/#django.db.models.query.QuerySet.extra
+* https://docs.djangoproject.com/en/stable/ref/models/querysets/#raw
+* https://docs.djangoproject.com/en/stable/ref/models/expressions/#raw-sql-expressions
+
+Recently addressed issues such as CVE-2025-59681 differ from your report since that class of issue concerns identifier escaping, whereas your report concerns value escaping. For raw SQL query APIs, responsibility for distinguishing between code (SQL) and data (user input) rests with the developer.
+
+For further clarification, please see our documentation on performing raw SQL queries: https://docs.djangoproject.com/en/stable/topics/db/sql/#performing-raw-sql-queries
+
+Best,
+Django Security Team.
+
 === Unauthenticated cache purge ===