| 161 | # ============================================================ |
| 162 | |
| 163 | class TestReplace879: |
| 164 | def test_tainted_silent_disabled(self): |
| 165 | # REPLACE879 disabled: str.replace() is a pure data transformation. |
| 166 | # Also caused FPs from os.replace(), node.replace(), code.replace() — any |
| 167 | # method named 'replace' matched regardless of receiver type. |
| 168 | code = """ |
| 169 | bad = request.GET.get('pattern') |
| 170 | result = sanitized.replace(bad, '') |
| 171 | """ |
| 172 | assert not fires(code, "REPLACE879"), "REPLACE879 disabled: str.replace() is not a security sink alone" |
| 173 | |
| 174 | def test_constant_replace_safe(self): |
| 175 | code = """ |
| 176 | result = user_name.replace('<', '<') |
| 177 | """ |
| 178 | assert not fires(code, "REPLACE879"), "REPLACE879 must NOT fire for constant search/replace" |
| 179 | |
| 180 | |
| 181 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected