hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: address review

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2020-10-20 23:59:44 +02:00
parent 01845d1278
commit e1dfbc0486
2 changed files with 87 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py
View File

@@ -2,30 +2,22 @@ from django.db import connection, models
from django.db.models.expressions import RawSQL
def test_plain(username):
# GOOD -- Using parameters
connection.cursor().execute("SELECT * FROM users WHERE username = %s", username) # $getSql="SELECT * FROM users WHERE username = %s"
# BAD -- Using string formatting
connection.cursor().execute("SELECT * FROM users WHERE username = '%s'" % username) # $getSql=BinaryExpr
def test_plain():
cursor = connection.cursor()
cursor.execute("some sql") # $getSql="some sql"
def test_context(username):
def test_context():
with connection.cursor() as cursor:
# GOOD -- Using parameters
cursor.execute("SELECT * FROM users WHERE username = %s", username) # $getSql="SELECT * FROM users WHERE username = %s"
cursor.execute("some sql") # $getSql="some sql"
# BAD -- Using string formatting
cursor.execute("SELECT * FROM users WHERE username = '%s'" % username) # $getSql=BinaryExpr
class User(models.Model):
pass
def test_model(username):
# GOOD -- Using parameters
User.objects.raw("SELECT * FROM users WHERE username = %s", (username,)) # $getSql="SELECT * FROM users WHERE username = %s"
# BAD -- other ways of executing raw SQL code with string interpolation
User.objects.annotate(RawSQL("insert into names_file ('name') values ('%s')" % username)) # $getSql=BinaryExpr
User.objects.raw("insert into names_file ('name') values ('%s')" % username) # $getSql=BinaryExpr
User.objects.extra("insert into names_file ('name') values ('%s')" % username) # $getSql=BinaryExpr
def test_model():
User.objects.raw("some sql") # $getSql="some sql"
User.objects.annotate(RawSQL("some sql")) # $getSql="some sql"
User.objects.annotate(val=RawSQL("some sql")) # $getSql="some sql"
User.objects.extra("some sql") # $getSql="some sql"