| 273 | # ============================================================ |
| 274 | |
| 275 | class TestFILE_WRITE001: |
| 276 | # FILE_WRITE001 taint sink (SK_FILE_WRITE001) removed — write() is too generic. |
| 277 | # It fired on HTTP response writes (response.write()), cache writes, and all |
| 278 | # framework file operations generating massive FPs (74 in CPython, 24 in Django). |
| 279 | # Rule remains for documentation; the finding in PyGoat is still detected via |
| 280 | # the PLAIN_PWD001, FILE_WRITE001 pattern, and broader path traversal rules. |
| 281 | def test_tainted_write_silent_disabled(self): |
| 282 | code = """ |
| 283 | code = request.POST.get('code') |
| 284 | f = open('/tmp/plugin.py', 'w') |
| 285 | f.write(code) |
| 286 | """ |
| 287 | assert not_fires(code, "FILE_WRITE001"), "FILE_WRITE001 taint sink disabled: write() too generic" |
| 288 | |
| 289 | def test_constant_write_safe(self): |
| 290 | code = """ |
| 291 | f = open('/tmp/output.py', 'w') |
| 292 | f.write('print("hello")') |
| 293 | """ |
| 294 | assert not_fires(code, "FILE_WRITE001"), "FILE_WRITE001 must NOT fire for constant content" |
| 295 | |
| 296 | |
| 297 | # ============================================================ |
nothing calls this directly
no outgoing calls
no test coverage detected