Collected research
plORMbing your Django ORM
User JSON passed into QuerySet.filter(**request.data) lets an attacker choose column and operator, so password__startswith turns response length into a character-by-character oracle. Relational lookups go further: created_by__user__password crosses models, a many-to-many loop like departments__employees reaches unrelated users, and categories__articles adds a join alias bypassing an is_secret=False filter. A regex tripping MySQL's regexp_time_limit gives an error oracle.
Record
- Researcher
- Alex Brown
- Published by
- elttam.com
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Alex Brown, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .