Changes between Version 22 and Version 23 of SecurityTeam

Timestamp:

Mar 24, 2026, 9:58:30 AM (13 days ago)

Author:

Jacob Walls

Comment:

Add canned response for FORBIDDEN_ALIAS_PATTERN

SecurityTeam

@@ -60 +60 @@
 
 Thanks for taking the time to submit it through the appropriate channel.
+
+Kind regards, the Django Security Team.
+
+=== Special characters in user-controlled aliases ===
+
+After review, we've determined we cannot confirm a security vulnerability from the provided information.
+
+In some circumstances in versions of Django before 6.1, the names of database objects are not quoted. If users can supply the names of these database objects, e.g. via an annotation employing `FilteredRelation`, then this situation may need to be analyzed for a security impact. Django uses a regular expression (`FORBIDDEN_ALIAS_PATTERN`) to reject dangerous characters. To propose additions to this regex, the Security Team needs to see an exploit that alters a query and successfully executes, instead of crashing on the database or in the ORM layer.
+
+Please resubmit if you can supply such a proof of concept.
 
 Kind regards, the Django Security Team.