| 226 | # =========================================================================== |
| 227 | |
| 228 | class TestSessionFixation: |
| 229 | def test_session_data_write_not_flagged(self): |
| 230 | """Writing data to request.session is normal Django usage, not session fixation.""" |
| 231 | code = """ |
| 232 | request.session[CSRF_SESSION_KEY] = request.META['CSRF_COOKIE'] |
| 233 | request.session['_messages'] = json.dumps(messages) |
| 234 | """ |
| 235 | assert findings_for_rule(code, "SESS744") == [], \ |
| 236 | "SESS744 should not fire for normal session data writes" |
| 237 | |
| 238 | # Note: the SESS744 rule now requires session.session_key = request.* |
| 239 | # which is rare/unusual — the rule is now intentionally narrow. |
| 240 | def test_session_key_assignment_narrowed(self): |
| 241 | """After fix, SESS744 has a narrow pattern and no longer fires on data writes.""" |
| 242 | code = """ |
| 243 | request.session['user_id'] = 42 |
| 244 | """ |
| 245 | # This should NOT fire anymore — it's normal session usage |
| 246 | assert findings_for_rule(code, "SESS744") == [], \ |
| 247 | "SESS744 should not fire for normal session data writes after fix" |
| 248 | |
| 249 | |
| 250 | # =========================================================================== |
nothing calls this directly
no outgoing calls
no test coverage detected