Fix binary parameter handling in SQL panel (#2391)

Co-authored-by: Eduardo Enriquez <eduardo.enriquez@fareharbor.com>
Co-authored-by: Tim Schilling <schilling711@gmail.com>

Author: 3 people

debug_toolbar/panels/sql/forms.py

@@ -1,5 +1,3 @@
-import json
-
 from django import forms
 from django.core.exceptions import ValidationError
 from django.db import connections
@@ -21,14 +19,6 @@ class SQLSelectForm(forms.Form):
     request_id = forms.CharField()
     djdt_query_id = forms.CharField()
 
-    def clean_params(self):
-        value = self.cleaned_data["params"]
-
-        try:
-            return json.loads(value)
-        except ValueError as exc:
-            raise ValidationError("Is not valid JSON") from exc
-
     def clean_alias(self):
         value = self.cleaned_data["alias"]
 
@@ -61,20 +51,25 @@ def clean(self):
         cleaned_data["query"] = query
         return cleaned_data
 
+    def _render_row(self, row):
+        return tuple(
+            bytes(v).hex() if isinstance(v, (memoryview, bytes)) else v for v in row
+        )
+
     def select(self):
         query = self.cleaned_data["query"]
         sql = query["raw_sql"]
-        params = json.loads(query["params"])
+        params = query["params"]
         with self.cursor as cursor:
             cursor.execute(sql, params)
             headers = [d[0] for d in cursor.description]
-            result = cursor.fetchall()
+            result = [self._render_row(row) for row in cursor.fetchall()]
             return result, headers
 
     def explain(self):
         query = self.cleaned_data["query"]
         sql = query["raw_sql"]
-        params = json.loads(query["params"])
+        params = query["params"]
         vendor = query["vendor"]
         with self.cursor as cursor:
             if vendor == "sqlite":
@@ -93,7 +88,7 @@ def explain(self):
     def profile(self):
         query = self.cleaned_data["query"]
         sql = query["raw_sql"]
-        params = json.loads(query["params"])
+        params = query["params"]
         with self.cursor as cursor:
             cursor.execute("SET PROFILING=1")  # Enable profiling
             cursor.execute(sql, params)  # Execute SELECT
@@ -113,7 +108,7 @@ def profile(self):
                 """
             )
             headers = [d[0] for d in cursor.description]
-            result = cursor.fetchall()
+            result = [self._render_row(row) for row in cursor.fetchall()]
             return result, headers
 
     def reformat_sql(self):

debug_toolbar/panels/sql/tracking.py

@@ -1,21 +1,25 @@
+import base64
 import contextlib
 import contextvars
 import datetime
-import json
 from time import perf_counter
 
 import django.test.testcases
 from django.apps import apps
+from django.core.exceptions import ImproperlyConfigured
 
 from debug_toolbar import settings as dt_settings
 from debug_toolbar.sanitize import force_str
 from debug_toolbar.utils import get_stack_trace, get_template_info
 
+Psycopg3Binary = None
+
 try:
     import psycopg
 
     PostgresJson = psycopg.types.json.Jsonb
     STATUS_IN_TRANSACTION = psycopg.pq.TransactionStatus.INTRANS
+    Psycopg3Binary = psycopg.Binary
 except ImportError:
     try:
         from psycopg2._json import Json as PostgresJson
@@ -24,6 +28,19 @@
         PostgresJson = None
         STATUS_IN_TRANSACTION = None
 
+try:
+    from psycopg2.extensions import Binary as Psycopg2Binary
+except ImportError:
+    Psycopg2Binary = None
+
+_PostGISAdapter = None
+try:
+    from django.contrib.gis.db.backends.postgis.adapter import (
+        PostGISAdapter as _PostGISAdapter,
+    )
+except (ImportError, ImproperlyConfigured):
+    pass
+
 # Prevents SQL queries from being sent to the DB. It's used
 # by the TemplatePanel to prevent the toolbar from issuing
 # additional queries.
@@ -133,6 +150,26 @@ def _decode(self, param):
         if isinstance(param, dict):
             return {key: self._decode(value) for key, value in param.items()}
 
+        # GeoDjango PostGIS geometry parameters: extract EWKB bytes and metadata
+        # so the adapter can be reconstructed on the way back out for SELECT/EXPLAIN.
+        if _PostGISAdapter is not None and isinstance(param, _PostGISAdapter):
+            return {
+                "__djdt_postgis__": base64.b64encode(param.ewkb).decode("ascii"),
+                "is_geometry": param.is_geometry,
+                "geography": param.geography,
+            }
+
+        # Binary data is handled by DebugToolbarJSONEncoder in store.py.
+        # Django's BinaryField calls connection.Database.Binary() which wraps
+        # bytes in a driver-specific adapter: psycopg2 uses .adapted, psycopg3
+        # uses .obj. memoryview: psycopg2/sqlite3 binary column values.
+        if isinstance(param, (bytes, bytearray, memoryview)):
+            return bytes(param)
+        if Psycopg2Binary is not None and isinstance(param, Psycopg2Binary):
+            return bytes(param.adapted)
+        if Psycopg3Binary is not None and isinstance(param, Psycopg3Binary):
+            return bytes(param.obj)
+
         # make sure datetime, date and time are converted to string by force_str
         CONVERT_TYPES = (datetime.datetime, datetime.date, datetime.time)
         return force_str(param, strings_only=not isinstance(param, CONVERT_TYPES))
@@ -165,10 +202,11 @@ def _record(self, method, sql, params):
         finally:
             stop_time = perf_counter()
             duration = (stop_time - start_time) * 1000
-            _params = ""
+            _params = None
             with contextlib.suppress(TypeError):
-                # object JSON serializable?
-                _params = json.dumps(self._decode(params))
+                # Decode params - binary data will be handled by DebugToolbarJSONEncoder
+                # in store.py when the panel data is serialized
+                _params = self._decode(params)
             template_info = get_template_info()
 
             # Sql might be an object (such as psycopg Composed).

debug_toolbar/store.py

@@ -1,3 +1,4 @@
+import base64
 import contextlib
 import functools
 import json
@@ -6,6 +7,7 @@
 from typing import Any
 
 from django.core.cache import caches
+from django.core.exceptions import ImproperlyConfigured
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import transaction
 from django.utils.module_loading import import_string
@@ -14,15 +16,49 @@
 from debug_toolbar.models import HistoryEntry
 from debug_toolbar.sanitize import force_str
 
+BINARY_SENTINEL = "__djdt_binary__"
+POSTGIS_SENTINEL = "__djdt_postgis__"
+
 
 class DebugToolbarJSONEncoder(DjangoJSONEncoder):
     def default(self, o):
+        # Handle binary data (e.g., GeoDjango EWKB geometry data)
+        if isinstance(o, (bytes, bytearray)):
+            return {BINARY_SENTINEL: base64.b64encode(o).decode("ascii")}
         try:
             return super().default(o)
         except (TypeError, ValueError):
             return force_str(o)
 
 
+def _binary_object_hook(obj):
+    if BINARY_SENTINEL in obj:
+        return base64.b64decode(obj[BINARY_SENTINEL])
+    if POSTGIS_SENTINEL in obj:
+        ewkb = base64.b64decode(obj[POSTGIS_SENTINEL])
+        try:
+            from django.contrib.gis.db.backends.postgis.adapter import PostGISAdapter
+
+            adapter = PostGISAdapter.__new__(PostGISAdapter)
+            adapter.is_geometry = obj.get("is_geometry", True)
+            adapter.ewkb = ewkb
+            adapter.geography = obj.get("geography", False)
+            return adapter
+        except (ImportError, ImproperlyConfigured):
+            return ewkb
+    return obj
+
+
+class DebugToolbarJSONDecoder(json.JSONDecoder):
+    """Custom JSON decoder that reconstructs binary data during parsing."""
+
+    def __init__(self, *args, **kwargs):
+        # Set object_hook if not already provided
+        if "object_hook" not in kwargs:
+            kwargs["object_hook"] = _binary_object_hook
+        super().__init__(*args, **kwargs)
+
+
 def serialize(data: Any) -> str:
     # If this starts throwing an exceptions, consider
     # Subclassing DjangoJSONEncoder and using force_str to
@@ -31,7 +67,7 @@ def serialize(data: Any) -> str:
 
 
 def deserialize(data: str) -> Any:
-    return json.loads(data)
+    return json.loads(data, cls=DebugToolbarJSONDecoder)
 
 
 class BaseStore:

docs/changes.rst

@@ -35,6 +35,10 @@ Pending
 * Support Django 6.2's handling of booleans for non-PostgreSQL databases.
 * Changed the SQL panel to show the "Select" and "Explain" action buttons for
   all queries, not just ``SELECT`` statements.
+* Fixed SQL panel handling of binary parameters (e.g. from ``BinaryField``)
+  and GeoDjango PostGIS geometry parameters. EWKB geometry adapters are now
+  serialized and reconstructed so that Select and Explain work correctly on
+  spatial queries.
 
 6.3.0 (2026-04-01)
 ------------------

tests/panels/test_sql.py

@@ -409,21 +409,21 @@ def test_param_conversion(self):
             # comparisons in MySQL.
             # Django 6.2 started passing true/false for all-non
             # postgres databases.
-            expected_bools = '["Foo", true, false]'
+            expected_bools = ["Foo", True, False]
         else:
-            expected_bools = '["Foo"]'
+            expected_bools = ["Foo"]
 
         if connection.vendor == "postgresql":
             # PostgreSQL always includes timezone
-            expected_datetime = '["2017-12-22 16:07:01+00:00"]'
+            expected_datetime = ["2017-12-22 16:07:01+00:00"]
         else:
-            expected_datetime = '["2017-12-22 16:07:01"]'
+            expected_datetime = ["2017-12-22 16:07:01"]
 
         self.assertEqual(
             tuple(query["params"] for query in self.panel._queries),
             (
                 expected_bools,
-                "[10, 1]",
+                [10, 1],
                 expected_datetime,
             ),
         )
@@ -443,7 +443,7 @@ def test_json_param_conversion(self):
         self.assertEqual(len(self.panel._queries), 1)
         self.assertEqual(
             self.panel._queries[0]["params"],
-            '["{\\"foo\\": \\"bar\\"}"]',
+            ['{"foo": "bar"}'],
         )
 
     @unittest.skipUnless(
@@ -468,7 +468,7 @@ def test_tuple_param_conversion(self):
 
         # ensure query was logged
         self.assertEqual(len(self.panel._queries), 1)
-        self.assertEqual(self.panel._queries[0]["params"], '[["a", "b\'"]]')
+        self.assertEqual(self.panel._queries[0]["params"], [["a", "b'"]])
 
     def test_binary_param_force_text(self):
         self.assertEqual(len(self.panel._queries), 0)
@@ -539,15 +539,13 @@ def test_raw_query_param_conversion(self):
         self.assertEqual(
             tuple(query["params"] for query in self.panel._queries),
             (
-                '["Foo", true, false, "2017-12-22 16:07:01"]',
-                " ".join(
-                    [
-                        '{"first_name": "Foo",',
-                        '"is_staff": true,',
-                        '"is_superuser": false,',
-                        '"date_joined": "2017-12-22 16:07:01"}',
-                    ]
-                ),
+                ["Foo", True, False, "2017-12-22 16:07:01"],
+                {
+                    "first_name": "Foo",
+                    "is_staff": True,
+                    "is_superuser": False,
+                    "date_joined": "2017-12-22 16:07:01",
+                },
             ),
         )
 

tests/test_integration.py

@@ -548,6 +548,29 @@ def test_sql_explain_postgres_json_field(self):
             )
             self.assertEqual(response.status_code, 404)
 
+    def test_sql_explain_binary_param(self):
+        """
+        Confirm explain works for queries with binary parameters (e.g. GeoDjango EWKB).
+        """
+        self.client.get("/execute_binary_sql/")
+        request_ids = list(get_store().request_ids())
+        request_id = request_ids[-1]
+        toolbar = DebugToolbar.fetch(request_id, SQLPanel.panel_id)
+        panel = toolbar.get_panel_by_id(SQLPanel.panel_id)
+        djdt_query_id = panel.get_stats()["queries"][-1]["djdt_query_id"]
+
+        url = "/__debug__/sql_explain/"
+        data = {
+            "signed": SignedDataForm.sign(
+                {
+                    "request_id": request_id,
+                    "djdt_query_id": djdt_query_id,
+                }
+            )
+        }
+        response = self.client.post(url, data)
+        self.assertEqual(response.status_code, 200)
+
     def test_sql_profile_checks_show_toolbar(self):
         self.client.get("/execute_sql/")
         request_ids = list(get_store().request_ids())