django.core.cache.backends.db does not escape table names

[Fraser Nevett]

The table name is simply inserted verbatim into the SQL using string formatting, for example:

cursor.execute("SELECT COUNT(*) FROM %s" % self._table)

If the table name contains characters that require escaping, the generated SQL will be invalid and cause errors to occur.

[Fraser Nevett]

Patch and tests

[Alfredo]

I don't think it is a bug

You need to use the following syntax cursor.execute(sql, [params]). If you perform a direct substitution it will have security issues.

​http://docs.djangoproject.com/en/dev/topics/db/sql/#performing-raw-sql-queries

[Fraser Nevett]

I'm pretty sure using cursor.execute would not work in this case because the value to be inserted is the table name; the second argument to cursor.execute is used for escaping values. Django specifically provides connection.ops.quote_name to quote the table name, which is what my patch updates the code to use.

The fact that no escaping is happening at all at the moment means that there is a bit of a security issue as it stands, though is not really exploitable because the table name comes from the settings file rather than end-user input.

[Russell Keith-Magee]

(In [12410]) Fixed #11623 -- Corrected table name quoting in db cache backend. Thanks to Fraser Nevett for the report and fix.

[Russell Keith-Magee]

(In [12414]) [1.1.X] Fixed #11623 -- Corrected table name quoting in db cache backend. Thanks to Fraser Nevett for the report and fix.

Backport of r12410 from trunk.

[Jacob]

Milestone 1.2 deleted