#30863: Queryset __repr__ can overload a database server in some cases
-------------------------------------+-------------------------------------
Reporter: Matt | Owner: nobody
Johnson |
Type: | Status: new
Uncategorized |
Component: Database | Version: 2.2
layer (models, ORM) | Keywords: queryset repr
Severity: Normal | __repr__
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
-------------------------------------+-------------------------------------
Consider a model like this:
{{{
class Result(models.Model):
# A Result object represents someone who took a quiz
result_id = models.AutoField(primary_key=True, ...)
quiz = models.ForeignKey("Quiz", ...) # assume this boils down to an
integer field
name = models.CharField(...)
Meta:
ordering = ['name']
}}}
Assume it has hundreds of millions of records, and no index on the "name"
column.
Typical usage might be something like
{{{
Result.objects.filter(quiz_id=123)
}}}
Now consider a bug in the usage, like:
{{{
Result.objects.filter(quiz_id="somestring") # notice we used a string to
filter
}}}
Django will throw an exception (rightfully so).
As part of the usual error reporting process in debug mode, Django may
eventually call repr() on the "base" queryset (that is essentially
Result.objects.all()).
QuerySet.__repr__ tries to be helpful by printing the first 21 results of
the evaluated query. Because the base queryset orders by the un-indexed
"name" column, this can easily overload the database when it does "SELECT
... FROM Result ORDER BY name LIMIT 21" (trying to sort hundreds of
millions of rows by an unindexed column)
Even with debug mode turned off, some error reporting tools like Sentry
will call repr on the queryset, creating the same problem in production.
I suggest not showing any query data in Queryset.__repr__.
--
Ticket URL: <https://code.djangoproject.com/ticket/30863>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.86cd5e061eabc65d48d9d42ec8fb5fe4%40djangoproject.com.
