Mercurial Repositories > eric / file comparison
comparison: eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoSqlInjection.py
eric6/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/djangoSqlInjection.py
- changeset 7622
- 384e2aa5c073
- parent 7613
- 382f89c11e27
- child 7923
- 91e843545d9a
equal
deleted
inserted
replaced
| 7621:ffd1f00ca376 | 7622:384e2aa5c073 |
|---|---|
| 14 # | 14 # |
| 15 # SPDX-License-Identifier: Apache-2.0 | 15 # SPDX-License-Identifier: Apache-2.0 |
| 16 # | 16 # |
| 17 | 17 |
| 18 import ast | 18 import ast |
| 19 | |
| 20 import AstUtilities | |
| 19 | 21 |
| 20 | 22 |
| 21 def getChecks(): | 23 def getChecks(): |
| 22 """ | 24 """ |
| 23 Public method to get a dictionary with checks handled by this module. | 25 Public method to get a dictionary with checks handled by this module. |
| 80 insecure = False | 82 insecure = False |
| 81 for key in ['where', 'tables']: | 83 for key in ['where', 'tables']: |
| 82 if key in kwargs: | 84 if key in kwargs: |
| 83 if isinstance(kwargs[key], ast.List): | 85 if isinstance(kwargs[key], ast.List): |
| 84 for val in kwargs[key].elts: | 86 for val in kwargs[key].elts: |
| 85 if not isinstance(val, ast.Str): | 87 if not AstUtilities.isString(val): |
| 86 insecure = True | 88 insecure = True |
| 87 break | 89 break |
| 88 else: | 90 else: |
| 89 insecure = True | 91 insecure = True |
| 90 break | 92 break |
| 91 if not insecure and 'select' in kwargs: | 93 if not insecure and 'select' in kwargs: |
| 92 if isinstance(kwargs['select'], ast.Dict): | 94 if isinstance(kwargs['select'], ast.Dict): |
| 93 for k in kwargs['select'].keys: | 95 for k in kwargs['select'].keys: |
| 94 if not isinstance(k, ast.Str): | 96 if not AstUtilities.isString(k): |
| 95 insecure = True | 97 insecure = True |
| 96 break | 98 break |
| 97 if not insecure: | 99 if not insecure: |
| 98 for v in kwargs['select'].values: | 100 for v in kwargs['select'].values: |
| 99 if not isinstance(v, ast.Str): | 101 if not AstUtilities.isString(v): |
| 100 insecure = True | 102 insecure = True |
| 101 break | 103 break |
| 102 else: | 104 else: |
| 103 insecure = True | 105 insecure = True |
| 104 | 106 |
| 124 @type dict | 126 @type dict |
| 125 """ | 127 """ |
| 126 if context.isModuleImportedLike('django.db.models'): | 128 if context.isModuleImportedLike('django.db.models'): |
| 127 if context.callFunctionName == 'RawSQL': | 129 if context.callFunctionName == 'RawSQL': |
| 128 sql = context.node.args[0] | 130 sql = context.node.args[0] |
| 129 if not isinstance(sql, ast.Str): | 131 if not AstUtilities.isString(sql): |
| 130 reportError( | 132 reportError( |
| 131 context.node.lineno - 1, | 133 context.node.lineno - 1, |
| 132 context.node.col_offset, | 134 context.node.col_offset, |
| 133 "S611", | 135 "S611", |
| 134 "M", | 136 "M", |
