| 252 | # =========================================================================== |
| 253 | |
| 254 | class TestCsrfExempt: |
| 255 | def test_csrf_exempt_not_flagged_in_tests(self): |
| 256 | """@csrf_exempt in test views is acceptable and should not fire.""" |
| 257 | code = """ |
| 258 | @csrf_exempt |
| 259 | def my_test_view(request): |
| 260 | return HttpResponse('ok') |
| 261 | """ |
| 262 | assert findings_for_rule(code, "CSRF747", in_tests_dir=True) == [], \ |
| 263 | "CSRF747 should not fire in test files" |
| 264 | |
| 265 | def test_csrf_exempt_still_flagged_in_production(self): |
| 266 | """@csrf_exempt in production code still warrants a warning.""" |
| 267 | code = "@csrf_exempt\ndef payment_webhook(request):\n return HttpResponse('ok')\n" |
| 268 | assert findings_for_rule(code, "CSRF747", filename="views.py", in_tests_dir=False) != [], \ |
| 269 | "CSRF747 should still fire in production code" |
| 270 | |
| 271 | |
| 272 | # =========================================================================== |
nothing calls this directly
no outgoing calls
no test coverage detected