| 56 | # ============================================================ |
| 57 | |
| 58 | class TestSetattr831: |
| 59 | def test_tainted_attr_name_fires(self): |
| 60 | code = """ |
| 61 | attr = request.GET.get('field') |
| 62 | setattr(user, attr, 'value') |
| 63 | """ |
| 64 | assert fires(code, "SETATTR831"), "SETATTR831 must fire: tainted attr name to setattr" |
| 65 | |
| 66 | def test_subscript_source_fires(self): |
| 67 | code = """ |
| 68 | attr = request.POST['field'] |
| 69 | setattr(obj, attr, True) |
| 70 | """ |
| 71 | assert fires(code, "SETATTR831"), "SETATTR831 must fire with subscript source" |
| 72 | |
| 73 | def test_constant_attr_safe(self): |
| 74 | code = """ |
| 75 | setattr(obj, 'username', 'alice') |
| 76 | """ |
| 77 | assert not fires(code, "SETATTR831"), "SETATTR831 must NOT fire for constant attr name" |
| 78 | |
| 79 | |
| 80 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected