【漏洞分析】CVE-2021-35042 Django SQL注入

1class User(models.Model):
2    name = models.CharField(max_length=200)
3
4     def __str__(self):
5         return self.name

1SELECT * FROM Websites ORDER BY alexa DESC;

 1def add_ordering(self, *ordering):
 2        """
 3        Add items from the 'ordering' sequence to the query's "order by"
 4        clause. These items are either field names (not column names) --
 5        possibly with a direction prefix ('-' or '?') -- or OrderBy
 6        expressions.
 7  If 'ordering' is empty, clear all ordering from the query.
 8         """
 9        errors = []
10        for item in ordering:
11            if isinstance(item, str):
12                if '.' in item:
13                    warnings.warn(
14                        'Passing column raw column aliases to order_by() is '
15                        'deprecated. Wrap %r in a RawSQL expression before '
16                        'passing it to order_by().' % item,
17                        category=RemovedInDjango40Warning,
18                        stacklevel=3,
19                    )
20                    continue
21                if item == '?':
22                    continue
23                if item.startswith('-'):
24                    item = item[1:]
25                if item in self.annotations:
26                    continue
27                if self.extra and item in self.extra:
28                    continue
29                # names_to_path() validates the lookup. A descriptive
30                # FieldError will be raise if it's not.
31                self.names_to_path(item.split(LOOKUP_SEP), self.model._meta)
32            elif not hasattr(item, 'resolve_expression'):
33                errors.append(item)
34            if getattr(item, 'contains_aggregate', False):
35                raise FieldError(
36                    'Using an aggregate in order_by() without also including '
37                    'it in annotate() is not allowed: %s' % item
38                )
39        if errors:
40            raise FieldError('Invalid order_by arguments: %s' % errors)
41        if ordering:
42            self.order_by += ordering
43        else:
44            self.default_ordering = False

 1def names_to_path(self, names, opts, allow_many=True, fail_on_missing=False):
 2    path, names_with_path = [], []
 3    for pos, name in enumerate(names):
 4        cur_names_with_path = (name, [])
 5        if name == 'pk':
 6            name = opts.pk.name
 7
 8   field = None
 9        filtered_relation = None
10        try:
11            field = opts.get_field(name)
12        except FieldDoesNotExist:
13            if name in self.annotation_select:
14                field = self.annotation_select[name].output_field
15            elif name in self._filtered_relations and pos == 0:
16                filtered_relation = self._filtered_relations[name]
17                field = opts.get_field(filtered_relation.relation_name)
18        if field is not None:
19            # Fields that contain one-to-many relations with a generic
20            # model (like a GenericForeignKey) cannot generate reverse
21            # relations and therefore cannot be used for reverse querying.
22            if field.is_relation and not field.related_model:
23                raise FieldError(
24                    "Field %r does not generate an automatic reverse "
25                    "relation and therefore cannot be used for reverse "
26                    "querying. If it is a GenericForeignKey, consider "
27                    "adding a GenericRelation." % name
28                )
29            try:
30                model = field.model._meta.concrete_model
31            except AttributeError:
32                # QuerySet.annotate() may introduce fields that aren't
33                # attached to a model.
34                model = None
35        else:
36            # We didn't find the current field, so move position back
37            # one step.
38            pos -= 1
39            if pos == -1 or fail_on_missing:
40                available = sorted([
41                    *get_field_names_from_opts(opts),
42                    *self.annotation_select,
43                    *self._filtered_relations,
44                ])
45                raise FieldError("Cannot resolve keyword '%s' into field. "
46                                 "Choices are: %s" % (name, ", ".join(available)))
47            break

 1def get_field(self, field_name):
 2    """
 3    Return a field instance given the name of a forward or reverse field.
 4    """
 5    try:
 6        # In order to avoid premature loading of the relation tree
 7        # (expensive) we prefer checking if the field is a forward field.
 8        return self._forward_fields_map[field_name]
 9    except KeyError:
10        # If the app registry is not ready, reverse fields are
11        # unavailable, therefore we throw a FieldDoesNotExist exception.
12        if not self.apps.models_ready:
13            raise FieldDoesNotExist(
14                "%s has no field named '%s'. The app cache isn't ready yet, "
15                "so if this is an auto-created related field, it won't "
16                "be available yet." % (self.object_name, field_name)
17            )
18  try:
19        # Retrieve field instance by name from cached or just-computed
20        # field map.
21        return self.fields_map[field_name]
22    except KeyError:
23        raise FieldDoesNotExist("%s has no field named '%s'" % (self.object_name, field_name))