| 138 | # ============================================================ |
| 139 | |
| 140 | class TestFstring867: |
| 141 | # FSTRING867 is disabled as a standalone sink — f-string taint propagates forward |
| 142 | # to downstream sinks (LOG741, PY101, PATH813, etc.) which report it more precisely. |
| 143 | # As a standalone sink it fires on every display/error string in large codebases. |
| 144 | def test_tainted_variable_silent_disabled(self): |
| 145 | code = """ |
| 146 | cmd = request.GET.get('cmd') |
| 147 | query = f'SELECT * FROM {cmd}' |
| 148 | """ |
| 149 | assert not fires(code, "FSTRING867"), "FSTRING867 disabled: downstream PY101 covers this" |
| 150 | |
| 151 | def test_constant_fstring_safe(self): |
| 152 | code = """ |
| 153 | name = 'Alice' |
| 154 | greeting = f'Hello {name}!' |
| 155 | """ |
| 156 | assert not fires(code, "FSTRING867"), "FSTRING867 must NOT fire for f-string with local constant" |
| 157 | |
| 158 | |
| 159 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected