hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Support django models (with some caveats)

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2020-10-20 03:20:00 +02:00
parent d7308bddf2
commit 5990241c8f
2 changed files with 175 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
View File

@@ -1,4 +1,5 @@
from django.db import connection, models
from django.db.models.expressions import RawSQL
def test_plain(username):
@@ -16,3 +17,15 @@ def test_context(username):
# BAD -- Using string formatting
cursor.execute("SELECT * FROM users WHERE username = '%s'" % username) # $getSql=BinaryExpr
class User(models.Model):
pass
def test_model(username):
# GOOD -- Using parameters
User.objects.raw("SELECT * FROM users WHERE username = %s", (username,)) # $getSql="SELECT * FROM users WHERE username = %s"
# BAD -- other ways of executing raw SQL code with string interpolation
User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username)) # $getSql=BinaryExpr
User.objects.raw("insert into names_file ('name') values ('%s')" % username) # $getSql=BinaryExpr
User.objects.extra("insert into names_file ('name') values ('%s')" % username) # $getSql=BinaryExpr