#28992: Querying GenericIPAddressField with a space crashes with DataError on
PostgreSQL
-------------------------------------+-------------------------------------
Reporter: Vlada Macek | Owner: Can
| Sarıgöl
Type: Bug | Status: assigned
Component: Database layer | Version: master
(models, ORM) |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Carlton Gibson):
> What is clearly wrong IMHO is 500 from using the admin.
#30064 adds a form to `ChangeList` to validate the search query input.
You'll be able to subclass `ChangeList`, and override `get_changelist()`,
to customise that form (adding an additional validator for IP addresses,
say).
If you have multiple search fields, you'll likely need to override
`get_search_results()`
[https://docs.djangoproject.com/en/2.2/ref/contrib/admin/#django.contrib.admin.ModelAdmin.get_search_results
see the docs for that], since the same query value is used to filter on
all the fields. (Something like `django-filter` would allow per field
validation and filtering, but not from a single search box normally...)
From the UI perspective, I think that's more or less all we can really do
here. [https://code.djangoproject.com/ticket/30064#comment:3 Simon's
comment from #30064] sums it up:
> In my opinion the issue is that the admin is relying on unsanitized
request.GET passing to the ORM, that looks like the same class of issues
as Model.objects.get(int_field='foo'). The admin should use a form to
sanitize the input...
(See too the "User input should be sanitized before feeding it to the
ORM." below that.)
Validating against null characters is something we can apply to all input,
but IP addresses, say, are only going to apply sometimes, so the developer
needs to adjust the form themselves. (Short of a django-filter like
mechanism that will generate a full model-form, which is out of scope
here.)
As per the rest of the discussion here, what that leaves for this ticket
is the ORM behaviour: to raise a ValueError before hitting the DB in this
case.
--
Ticket URL: <https://code.djangoproject.com/ticket/28992#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.c8d9610163d7e3e5b69e13af19593687%40djangoproject.com.
