DJG104.md

DJG104

Instantiating Django expressions with a dangerous template string literal.

This check looks at direct instantiations of the :

• django.db.models.Func
• django.db.models.Aggregate
• django.db.models.Window
• django.db.models.Expression
• django.db.models.lookups.Transform

It will also look at calls to super().as_sql(), or self.as_sql() in classes which inherit from these types.

New classes to any of these types will also have their template attributes inspected.

Examples

from django.db.models import F, Func

queryset.annotate(field_lower=Func(F('field'), function='LOWER', template="'%(function)s'(%(expressions)s)"))

This inheritance example would also raise a warning:

class ConcatPair(Func):
    function = 'CONCAT'

    def as_mysql(self, compiler, connection, **extra_context):
        return super().as_sql(
            compiler, connection,
            function='CONCAT_WS',
            template="'%s'",
            **extra_context
        )

This child class would also raise a warning

class Example(Expression):
    function = 'EXAMPLE'
    template = "%(function)('%(special)s')"

Fixes

Remove the quotations from the expressions:

from django.db.models import F, Func

queryset.annotate(field_lower=Func(F('field'), function='LOWER', template="%(function)s(%(expressions)s)"))

See Also

• Official Documentation