django-import-export / django-import-export / 29761174005

100%

push

github

Fix CachedInstanceLoader to raise MultipleObjectsReturned on duplicate import id (#2162) (#2169)

* fix: raise MultipleObjectsReturned for duplicate import id in CachedInstanceLoader (#2162)

CachedInstanceLoader built its instance cache with a dict comprehension
keyed on the import id, so when two rows shared an import id the second
silently overwrote the first and get_instance() returned only the last
match. ModelInstanceLoader, which calls QuerySet.get(), already raises
MultipleObjectsReturned in this case. Track duplicate import ids while
building the cache and raise the same exception from get_instance() so
the two loaders behave consistently.

* fix: address cached loader duplicate review

* Don't leak the import id value in the duplicate-match error

Per review: the user-supplied import id value was interpolated into the
MultipleObjectsReturned message, so an attacker-controlled string could reach
logs that may render it unescaped. Report only the configured field name and
assert the value no longer appears in the message.

11 of 11 new or added lines in 1 file covered. (100.0%)

2303 of 2304 relevant lines covered (99.96%)

3.0 hits per line