# Hostile expression corpus — every line must raise AskValidationError.
# Lines starting with # are comments. The validator is configured with
# Order/Customer as allowed models in the test.
# -- writes & mutations --------------------------------------------------
Order.objects.all().delete()
Order.objects.filter(status="pending").delete()
Order.objects.filter(status="pending").update(status="paid")
Order.objects.update(total=0)
Order.objects.bulk_update([], ["status"])
Order.objects.bulk_create([])
Order.objects.create(status="paid")
Order.objects.get_or_create(status="paid")
Order.objects.update_or_create(status="paid")
Order.objects.first().delete()
Order.objects.first().save()
Customer.objects.all().delete()
Customer.objects.create(name="x")
Order.objects.filter(pk=1).first().save()
# -- raw SQL --------------------------------------------------------------
Order.objects.raw("SELECT * FROM orders")
Order.objects.extra(where=["1=1"])
Order.objects.raw("DROP TABLE orders")
Customer.objects.raw("SELECT * FROM auth_user")
Order.objects.extra(select={"x": "password"})
# -- eval / exec / compile / import ---------------------------------------
eval("1+1")
exec("import os")
compile("1", "<s>", "eval")
__import__("os")
__import__("os").system("rm -rf /")
import os
import subprocess
Order.objects.filter(pk=eval("1"))
Order.objects.filter(pk=exec("1"))
Order.objects.annotate(x=eval("Count('id')"))
# -- dunder & attribute escapes --------------------------------------------
Order.__class__
Order.__subclasses__()
Order.__init__.__globals__
Order.objects.__class__.__mro__
().__class__.__bases__[0].__subclasses__()
Order.objects.filter().__class__
Order._meta
Order._default_manager.all()
Order.objects._db
Order.objects.all()._clone()
Customer.__dict__
Order.objects.get.__self__
type(Order)
getattr(Order, "objects")
setattr(Order, "x", 1)
delattr(Order, "objects")
vars(Order)
globals()
locals()
dir(Order)
# -- os / sys / filesystem ---------------------------------------------------
os.system("ls")
os.popen("whoami")
sys.exit()
open("/etc/passwd")
open("/etc/passwd").read()
subprocess.run(["ls"])
subprocess.Popen("ls")
pickle.loads(b"")
breakpoint()
input()
Order.objects.filter(status=open("/etc/passwd").read())
# -- cursor / connection --------------------------------------------------
connection.cursor()
Order.objects.db_manager("default")
cursor.execute("SELECT 1")
Order.objects.raw
django.db.connection.cursor()
# -- lambdas, comprehensions, ternaries, f-strings ----------------------------
[o for o in Order.objects.all()]
{o.pk: o for o in Order.objects.all()}
(o for o in Order.objects.all())
{o.pk for o in Order.objects.all()}
lambda: Order.objects.all()
Order.objects.all() if True else None
f"{Order.objects.count()}"
Order.objects.filter(pk=(lambda: 1)())
sorted(Order.objects.all(), key=lambda o: o.pk)
# -- unknown names / models outside scope -----------------------------------
User.objects.all()
Payroll.objects.all()
Session.objects.all()
ContentType.objects.all()
SomeModel.objects.count()
settings.SECRET_KEY
django.conf.settings.DATABASES
request.user
self.request
model.objects.all()
# -- forbidden queryset methods -----------------------------------------------
Order.objects.all().iterator()
Order.objects.select_for_update()
Order.objects.all().explain()
Order.objects.in_bulk([1, 2])
Order.objects.get(pk=1)
Order.objects.all().as_manager()
Order.objects.all().query
Order.objects.filter(pk=1).db
# -- scope-escaping lookup paths ---------------------------------------------
Order.objects.filter(customer__ssn="123")
Order.objects.values("customer__ssn")
Order.objects.filter(internal_margin__gt=0)
Order.objects.values("internal_margin")
Order.objects.order_by("internal_margin")
Order.objects.filter(customer__user__password="x")
Order.objects.values_list("customer__user__password")
Order.objects.filter(nonexistent_field=1)
Order.objects.values("customer__user__email")
Order.objects.annotate(x=Max("internal_margin"))
Order.objects.aggregate(x=Sum("internal_margin"))
Order.objects.filter(customer___hidden=1)
Order.objects.filter(_private=1)
Order.objects.order_by("-internal_margin")
# -- string positional smuggling ---------------------------------------------
Order.objects.filter("customer__ssn")
Order.objects.exclude("internal_margin")
# -- dangerous slicing / subscripts ------------------------------------------
Order.objects.all()[-1]
Order.objects.all()[0:10:2]
Order.objects.all()[Order.objects.count()]
Order.objects.all()[-5:]
Order.objects.all()["key"]
# -- chained trickery ------------------------------------------------------
Order.objects.all().delete
Order.objects.filter(pk=1).update
(Order.objects.all()).delete()
Order.objects.annotate(x=Count("id")).delete()
Order.objects.none().create(status="x")
# -- unicode homoglyphs & obfuscation ---------------------------------------
Оrder.objects.all()
Order.objects.аll()
ｅval("1")
Order.objects.filter(pk=int("1"))
Order.objects.filter(pk=str(1))
Order.objects.filter(pk=abs(-1))
Order.objects.filter(pk=len("x"))
bytes(Order)
Order.objects.filter(status=b"paid")
# -- comment / whitespace smuggling -----------------------------------------
Order.objects.all() # .delete()
Order.objects.all()\n.delete()
Order . objects . all ( ) . delete ( )
Order.objects.  delete  ()
# -- boolean / arithmetic escapes -------------------------------------------
1 and Order.objects.all()
Order.objects.all() or open("/etc/passwd")
not Order.objects.exists()
Order.objects.count() == 1
Order.objects.count() > 0 < open("x")
Order if True else Customer
# -- starred/kwargs smuggling ------------------------------------------------
Order.objects.filter(**{"customer__ssn": "1"})
Order.objects.filter(**kwargs)
Q(**{"customer__ssn": "x"})
Order.objects.filter(*args)
# -- builtins resurrection ----------------------------------------------------
[].__class__.__base__.__subclasses__()
"".join(["a"])
str.format("{0.__class__}", Order)
"{}".format(Order)
repr(Order)
hash(Order)
id(Order)
memoryview(b"x")
bytearray(b"x")
object()
super(Order)
classmethod(lambda: 1)
staticmethod(lambda: 1)
property(lambda: 1)
# -- statements disguised ------------------------------------------------------
Order.objects.all(); import os
x = Order.objects.all()
del Order
assert Order
raise Exception("x")
yield Order
await Order.objects.aall()
# -- name shadowing / walrus ---------------------------------------------------
(x := Order.objects.all())
Order.objects.filter(pk=(y := 1))
# -- misc hostile -----------------------------------------------------------
help(Order)
copyright
license()
exit()
quit()
Ellipsis
NotImplemented
...
Order.objects.filter(pk=...)
print(Order.objects.all())
map(str, Order.objects.all())
filter(None, Order.objects.all())
zip(Order.objects.all())
list(Order.objects.all())
tuple(Order.objects.all())
set(Order.objects.all())
dict(Order.objects.values())
iter(Order.objects.all())
next(iter(Order.objects.all()))
isinstance(Order, type)
issubclass(Order, object)
callable(Order)
format(Order)
ascii(Order)
chr(65)
ord("A")
hex(1)
oct(1)
bin(1)
round(1.5)
divmod(1, 2)
pow(2, 3)
sum([1, 2])
min([1])
max([1])
enumerate([1])
reversed([1])
slice(1)
range(10)
frozenset([1])
complex(1)
float("inf")
bool(1)
int("999999999999")
Order.objects.filter(created_at__gte=date.fromtimestamp(0))
Order.objects.filter(created_at__gte=date.fromordinal(1))
Order.objects.filter(created_at__gte=datetime.strptime("x", "%Y"))
Order.objects.filter(created_at__gte=timezone.now().tzinfo)
Order.objects.filter(created_at__gte=timezone.activate("UTC"))
Order.objects.filter(created_at__gte=date.today().ctime())
Order.objects.all().today()
Order.objects.filter(created_at__date=Order.today())
