| 194 | # =========================================================================== |
| 195 | |
| 196 | class TestCredentialRules: |
| 197 | def test_auth711_not_flagged_in_tests(self): |
| 198 | """username='admin' in test files should not trigger AUTH711.""" |
| 199 | code = """ |
| 200 | cls.user = User(username='admin', is_staff=True) |
| 201 | """ |
| 202 | assert findings_for_rule(code, "AUTH711", in_tests_dir=True) == [], \ |
| 203 | "AUTH711 should not fire in tests/ directory" |
| 204 | |
| 205 | def test_admin795_not_flagged_in_tests(self): |
| 206 | """admin/password in test files should not trigger ADMIN795.""" |
| 207 | code = """ |
| 208 | self.admin_login(username='testing', password='password') |
| 209 | """ |
| 210 | assert findings_for_rule(code, "ADMIN795", in_tests_dir=True) == [], \ |
| 211 | "ADMIN795 should not fire in tests/ directory" |
| 212 | |
| 213 | # True positives |
| 214 | def test_auth711_flagged_in_production_code(self): |
| 215 | """Hardcoded admin username assignment in production code should still trigger AUTH711.""" |
| 216 | code = """ |
| 217 | username = 'admin' |
| 218 | user = authenticate(username=username) |
| 219 | """ |
| 220 | assert findings_for_rule(code, "AUTH711", in_tests_dir=False) != [], \ |
| 221 | "AUTH711 should still fire for hardcoded admin username in production code" |
| 222 | |
| 223 | |
| 224 | # =========================================================================== |
nothing calls this directly
no outgoing calls
no test coverage detected